Russian snoops add OAuth abuse to targeted phishing campaigns
- ID
- 16347
- Status
- summarized
- Published
- 21 Aug 2026, 8:19 AM
- Fetched
- 21 Aug 2026, 2:19 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/21/russian-snoops-add-oauth-abuse-to-targeted-phishing-campaigns/5290706
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 5.5
- Created
- 21 Aug 2026, 2:19 PM
- Tags
- Audience
- developersai-agent-users
What happened
Google's Threat Intelligence Group is tracking three suspected Russian cyber-spy groups (UNC6293, UNC7005, UNC5976) that have added OAuth phishing to their toolkit, targeting under 100 individuals per campaign in academia, aerospace, defense, government, and think tanks across Europe and the US. UNC6293, linked to APT29/Cozy Bear, now requests victims share either the full callback URL or the verification code after a legitimate OAuth login to an external provider, allowing attackers to hijack the token exchange without needing passwords.
Why it matters
If you build apps that use OAuth flows, attackers are actively social-engineering the token-handoff step — specifically asking users to paste the verification code or full redirect URL. Review whether your OAuth UX makes it obvious to users that they should never share a verification code or callback URL with anyone, and consider whether your app's consent screen warns users about this attack pattern.
Discussion angle
How OAuth's legitimate-looking redirect-and-code flow creates a social engineering surface that credential phishing doesn't — and what SaaS builders can do in their consent UX to make code-sharing attacks harder to fall for