Russian Clusters Exploit OAuth Flows to Hijack Accounts

Three suspected Russian cyber espionage clusters are abusing legitimate Google OAuth and WhatsApp account-linking flows to compromise accounts at academic institutions, aerospace and defense firms, government bodies, and think tanks across Europe and the United States. Google’s Threat Intelligence Group documented the activity in research published by The Hacker News on August 20, 2026, naming the clusters UNC6293, UNC7005, and UNC5976.

The technique

No zero-days. No lookalike login pages. These clusters initiate legitimate OAuth authorization flows or WhatsApp account-linking sequences, then manipulate what happens at the authorization-grant or device-linking stage. The user interacts with a real authentication UI — Google’s or WhatsApp’s own. The abuse happens after the legitimate flow is underway, not by faking it.

That’s what makes this harder to catch than credential phishing: the browser URL is correct, the certificate is valid, and the auth flow is real. The manipulation is in how the resulting grant or linked session is captured.

Who’s being targeted

The clusters focus on specific individuals, not broad credential spray. High-value sectors:

• Academic institutions (Europe and US)
• Aerospace and defense
• Government agencies
• Think tanks (both Europe and US)

All three clusters share the targeting pattern. European targets appear across all three; U.S. targets are concentrated in academia and think tanks. Attribution to Russia is assessed as likely — not confirmed.

What to check now

OAuth abuse of this type leaves traces in authorization logs. Look for:

• Unexpected OAuth grants on executive, researcher, or government-liaison accounts — new grants to app IDs outside your standard toolset
• Unusually broad scope approvals on grants that should have narrow read-only access
• Authorization events at odd hours or from locations inconsistent with the user’s access patterns
• Unsolicited WhatsApp link-device prompts — treat these the same as unsolicited MFA push requests: escalate and deny, don’t approve

Audit active OAuth grants on high-risk accounts. Revoke anything outside approved tooling. Enable granular authorization-event alerts in Google Workspace or Microsoft Entra if you haven’t — grant-level events from unfamiliar app IDs are worth the noise.

If your organization sits in the target profile (academic research, defense contractor, think tank, government-adjacent), treat this as a current active-threat posture question, not a theoretical one.

Context

Abusing legitimate platform infrastructure to avoid detection is a recurring pattern in nation-state operations. TWINLOOT used Microsoft SharePoint and Teams as C2 channels earlier this week — the same “blend into legitimate services” approach. China-linked clusters hit APAC government targets with AI-assisted tooling last month.

OAuth flow abuse is distinct from those techniques, but the operational logic is the same: legitimate services generate legitimate-looking log entries that are easier to miss or dismiss.

Full technical indicators and cluster-level attribution details are in Google’s original research, linked above.