Russian Hackers Abuse OAuth and WhatsApp Device Linking to Hijack High-Value Accounts

Suspected Russian cyber-espionage groups are increasingly turning ordinary sign-in and device-linking features into tools for account takeover.

Their latest campaigns do not depend on breaking passwords or exploiting a software flaw. Instead, they persuade targets to approve actions that appear legitimate.

The activity has targeted people in academia, aerospace, defense, government, nonprofit organizations, and think tanks across Europe and the United States.

Attackers use tailored conference invitations, diplomatic themes, file-sharing offers, and messages that create pressure to authenticate quickly.

Analysts at Google Cloud identified three distinct clusters, tracked as UNC6293, UNC7005, and UNC5976, using phishing, OAuth abuse, app-password theft, device-code lures, and malware.

Google assesses with high confidence that the clusters have a Russian nexus, based on targeting patterns, phishing themes, and operational methods.

Google Cloud said in a report shared with Cyber Security News (CSN) that the operations are troubling because the victim often interacts with a real authentication page or a genuine account feature.

That makes the scam look safer than a traditional fake login page and creates a blind spot for organizations that mainly monitor corporate accounts.

Recent Russian device-code phishing activity has already shown how attackers can misuse legitimate sign-in workflows to capture access tokens.

Russian Hackers Abuse OAuth and WhatsApp Device Linking

UNC7005, also known as STORM-2945, has used carefully selected phishing operations against individuals of interest to the Russian state.

Its lures commonly impersonate events, embassies, conferences, or trusted organizations, encouraging recipients to register, access documents, or join a secure conversation.

In one WhatsApp-focused campaign seen during May and June 2026, victims were directed to a fake page and asked to enter their phone number.

The page then generated a legitimate WhatsApp device-linking request for an attacker-controlled device and displayed the real QR code or linking code to the target.

If the target approved the request in WhatsApp, the attacker gained a linked session capable of accessing the victim’s messages.

This mirrors the wider risk documented in WhatsApp GhostPairing account hijacks, where social engineering turns a normal companion-device feature into unauthorized account access.

After device linking, UNC7005’s pages could present a fake voice call, encrypted chat, or file-transfer option.

The false call page used malicious browser code to record audio and video, while the chat path displayed credentials for a secondary login page. Google Cloud could not determine what file was staged in the file-transfer scenario.

The same cluster also abused OAuth flows against Google and Microsoft accounts. In August 2026, it used domains impersonating the Finnish Operations Center to target people connected to Europe’s defense sector.

Victims who selected “Sign in With Google” were taken to a real login page before being redirected to an attacker-controlled, unverified cloud project designed to collect authentication tokens.

That tactic differs from password theft because a victim can enter correct credentials only on a legitimate provider page and still give an attacker access.

Earlier reporting on Google services phishing abuse illustrates how trusted infrastructure can make malicious requests appear unusually convincing.

Malware, Defense, and Impact

UNC7005 also expanded beyond authentication abuse. In a broader campaign in late May 2026, attackers used a fake Ukraine-related summit site to distribute browser-information stealers to Windows and macOS users.

Windows visitors received VIDAR, while macOS users received ATOMIC, two malware families built to collect saved browser data such as credentials, cookies, addresses, and payment details.

These actors abuse legitimate features and infrastructure to make malicious activity harder to distinguish from normal account use. The affected accounts are often personal accounts, which may fall outside an employer’s normal monitoring coverage.

For defenders, the message is simple: a familiar-looking invitation, a valid QR code, or a genuine sign-in page does not prove the request is safe.

Similar Teams meeting invite attacks have demonstrated how valid device-code workflows can be weaponized to obtain durable access tokens without stealing passwords.

Users should inspect browser URLs before signing in, avoid proceeding past warnings for suspicious websites, and independently verify invitations through contact details obtained outside the message.

They should never share app passwords, verification codes, or a full authentication URL with another person.

Organizations should routinely review linked devices on both personal and work messaging accounts, enforce two-factor authentication and registration locks where available, and validate contacts through a separate channel.

High-risk users should remove unfamiliar linked devices immediately and treat unexpected requests to join “secure” chats or calls as potential phishing attempts.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC