#4
The Hacker News
general
August 20, 2026 at 19:59 UTC
Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
By [email protected] (The Hacker News)
AI Summary
Three suspected Russian cyber espionage clusters — UNC6293, UNC7005, and UNC5976 — are abusing legitimate Google OAuth flows and WhatsApp account-linking mechanisms to hijack accounts belonging to individuals in academia, aerospace/defense, government, and think tanks across Europe and the U.S. The clusters demonstrate persistent, adaptive tradecraft that bypasses traditional phishing indicators by exploiting trusted authentication infrastructure. Security teams should audit OAuth grant activity and enforce phishing-resistant MFA for high-risk personnel.
Relevance score: 85.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →