Russian Hackers Exploit Google OAuth and WhatsApp Linking in Multi-Platform Account Hijacking Campaigns

Suspected Russian cyber espionage groups are abusing legitimate authentication flows, including Google OAuth and WhatsApp device linking, to hijack accounts across Europe and the U.S., according to a new report from Google Threat Intelligence Group (GTIG).

Three threat clusters—UNC6293, UNC5976, and UNC7005—are conducting persistent phishing campaigns targeting academia, aerospace, defense, government, and think tanks. UNC6293, linked to Ice Relic (APT29/Cozy Bear/Midnight Blizzard), uses app password phishing and OAuth verification code theft. UNC5976 automates OAuth token collection via cloud infrastructure and fake file-sharing pages, also deploying the HEADRUSH Excel plugin to deliver HTA malware.

UNC7005 (Storm-2945) is the core focus, targeting Ukraine, Western Europe, and the U.S. It employs device code phishing for Microsoft and WhatsApp, spoofing WhatsApp to trick victims into linking attacker-controlled devices. The group also uses commodity infostealers like Vidar and Atomic (AMOS), and conducts OAuth phishing via domains spoofing the Finnish Operations Center (FOC) in NATO contexts.

These efforts align with the CaptiveCrunch campaign, documented by ReliaQuest and Microsoft, which compromises captive Wi-Fi portals to redirect users to attacker infrastructure. Lumen Black Lotus Labs suggests possible MSP compromise, indicating a supply chain risk. The campaign deploys CornFlake RAT and ChocoShell (CHERRYPIE) malware, managed via the FruitStone C2 panel.

GTIG warns that the creative abuse of legitimate features makes tracking malicious access more challenging, enabling quick exfiltration and further phishing from compromised accounts.