Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to target individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S. The clusters, identified as UNC6293, UNC7005, and UNC5976, are engaging in persistent and adaptive campaigns that abuse Google OAuth and WhatsApp linking to hijack accounts.

The attacks exploit the trust users place in legitimate authentication flows. By abusing Google OAuth and WhatsApp linking, the threat actors can bypass traditional security controls and gain unauthorized access to targeted accounts. The exact technical mechanism of the abuse is not fully disclosed, but it underscores the risk of relying solely on authentication protocols without additional verification.

The campaigns are ongoing, with the report published on August 20, 2026. The targeting of high-value individuals in academia, defense, and government suggests a focus on intelligence gathering and espionage. The use of legitimate services makes detection more challenging, as the activity may appear normal to security tools.

Attribution to Russian state-sponsored actors is reported but not independently confirmed. The threat actors are described as persistent and adaptive, indicating a sophisticated and well-resourced operation.

Organizations and individuals in the targeted sectors should be vigilant against phishing and social engineering attempts that may initiate these attacks. Verifying unexpected authentication requests and implementing strong multi-factor authentication (MFA) are critical steps. There is no specific software patch, as the abuse leverages legitimate protocol functionality.