Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

Sophisticated Russian threat actors are exploiting legitimate authentication mechanisms — including Google OAuth flows and WhatsApp account linking — rather than breaking encryption, making attacks harder to detect with traditional security tools. The root problem lies in users being manipulated through social engineering into granting attackers valid authentication tokens, effectively handing over access without any vulnerability being exploited. The use of rogue plugins like HEADRUSH and fake file-sharing pages demonstrates that these actors blend technical and human-layer attacks, bypassing technical controls by targeting the weakest link: human trust. This matters because compromised OAuth tokens grant persistent, broad access to accounts and connected services, and victims in academia, defense, and government represent high-value intelligence targets. Organizations that rely solely on passwords or lack behavioral monitoring will struggle to detect these intrusions until significant damage is done.