Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
- ID
- 16260
- Status
- summarized
- Published
- 21 Aug 2026, 3:59 AM
- Fetched
- 21 Aug 2026, 6:04 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/suspected-russian-hackers-abuse-google.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.5
- Created
- 21 Aug 2026, 6:07 AM
- Tags
- Audience
- developerssaas_founders
What happened
Google Threat Intelligence Group identified three suspected Russian espionage clusters (UNC6293, UNC7005, UNC5976) abusing legitimate Google OAuth flows to hijack accounts of individuals in academia, aerospace, defense, and government across Europe and the U.S. UNC6293, linked to APT29/Cozy Bear, targets fewer than five users at a time while impersonating State Department officials; UNC5976 buys file-sharing-themed domains and spins up cloud projects to host fake file-sharing pages that trigger OAuth login pop-ups. The core technique is tricking users into sharing either the full URL or verification code after a legitimate login to an external provider, which hands attackers account access.
Why it matters
If you build apps that use OAuth or any flow where users receive a verification code or callback URL, this confirms that attackers are actively exploiting the human step—asking users to paste the code or URL into a chat. Consider whether your auth UX makes this kind of social engineering easier: avoid flows where a code or URL is the sole factor and educate users never to share OAuth codes or callback URLs, since nation-state actors are already doing this at scale.
Discussion angle
How to design OAuth flows that are resistant to users being socially engineered into sharing verification codes or callback URLs—what UX patterns make this harder for attackers?