Russian Hackers Abuse OAuth and WhatsApp Device Linking to Hijack High

Cybersecuritynews •Tushar Subhra Dutta • August 21, 2026

Suspected Russian cyber-espionage groups are increasingly turning ordinary sign-in and device-linking features into tools for account takeover. Their latest campaigns do not depend on breaking passwords or exploiting a software flaw. Instead, they persuade targets to approve actions that appear legitimate. The activity has targeted people in academia, aerospace, defense, government, nonprofit organizations, and think […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian Cyber Espionage Clusters Exploit OAuth and Phishing Techniques Google's Threat Intelligence Group (GTIG) is tracking three Russian cyber espionage clusters—UNC6293, UNC7005, and UNC5976—targeting individuals in academia, defense, and government across Europe and the U.S. These groups exploit legitimate authentication workflows, such as OAuth and app password phishing, to compromise accounts. UNC6293 impersonates U.S. State Department officials, while UNC7005 and UNC5976 employ various social engineering tactics, including fake invitations and device linking. The attacks are highly selective, often targeting fewer than 100 individuals at a time, but they pose significant risks due to their sophisticated methods. GTIG has observed these operations since at least 2025, with ongoing adaptations to their phishing techniques. The current status indicates a persistent threat as these clusters continue to evolve their tactics. 15 sources 76

Extracted Entities

Platforms (2)

OAuth WhatsApp