[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcPGL7qTpCFwDwRR-TAMN10Uo0cKMj4BVEhWChTVp958":3},{"article":4,"iocs":48,"watch_terms":53,"solutions":54,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"f4018cfd-8c74-4686-b6f7-8441f3c5b625","Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts","suspected-russian-hackers-abuse-google-oauth-and-whatsapp-linking-to-hijack-acco-42c3af","Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S. These clusters include UNC6293, UNC7005, and UNC5976. \"These clusters engage in persistent, adaptive","Three suspected Russian cyber espionage threat clusters (UNC6293, UNC7005, and UNC5976) are targeting individuals in academia, aerospace, defense, government, and think tanks in Europe and the U.S. They are abusing legitimate authentication flows like Google OAuth and WhatsApp linking, employing sophisticated social engineering and phishing tactics to compromise accounts. UNC6293, linked to APT29, uses app password phishing, while UNC5976 automates token collection via cloud infrastructure and fake file-sharing pages. UNC7005 also uses a rogue Excel plugin called HEADRUSH to deliver malware, targeting Ukraine and Armenia.","Russian threat actors exploit Google OAuth and WhatsApp linking for account hijacking.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fsuspected-russian-hackers-abuse-google.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEix5lAWOEf4I8fcz0CJYg-EBclOrTPnlbsf6tKT2-L8xsfQ4XqtjOq15iU6EBbIsWlqQq3e1-hIXrPe7MMg4JwSGj6mSwjSwG8V3UFMrfgYD-Lo9bKvncTGJ9lPbZoxq-1RNmKLyL_jZSiurWVgGuIxjgYYJeXW_wE51PRTDUhT7kRxp0MMpc3YflI9bntb\u002Fs1600\u002Fgoogle-whatsapp.jpg","2026-08-20T19:59:19+00:00","2026-08-20T22:00:15.37262+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"UNC6293","threat_actor",{"name":21,"type":19},"UNC7005",{"name":23,"type":19},"UNC5976",{"name":25,"type":19},"Ice Relic",{"name":27,"type":19},"APT29",{"name":29,"type":19},"Cozy Bear","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":50,"value":51,"context":52},"malware","HEADRUSH","Rogue Excel plugin used by UNC7005 to deliver HTA malware.",[],{"controls":55,"vendors":140},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":86,"name":87,"problem":88,"products":89},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":115,"name":116,"problem":117,"products":118},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":136,"product_name":137,"url":138,"description":139},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[141],{"slug":142,"name":143,"logo_path":144,"roles":145},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[146],"reported_by",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":168},"russian-apt-groups-hijack-accounts-via-oauth-abuse-and-social-engineering","Russian APT Groups Hijack Accounts via OAuth Abuse and Social Engineering","Sophisticated Russian threat actors are exploiting legitimate authentication mechanisms — including Google OAuth flows and WhatsApp account linking — rather than breaking encryption, making attacks harder to detect with traditional security tools. The root problem lies in users being manipulated through social engineering into granting attackers valid authentication tokens, effectively handing over access without any vulnerability being exploited. The use of rogue plugins like HEADRUSH and fake file-sharing pages demonstrates that these actors blend technical and human-layer attacks, bypassing technical controls by targeting the weakest link: human trust. This matters because compromised OAuth tokens grant persistent, broad access to accounts and connected services, and victims in academia, defense, and government represent high-value intelligence targets. Organizations that rely solely on passwords or lack behavioral monitoring will struggle to detect these intrusions until significant damage is done.",[152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 16 – Application Software Security","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 AU-12 (Audit Record Generation)","NIST CSF ID.AM-3 (Organizational communications mapped)","NIST CSF PR.AC-4 (Access permissions managed)","MITRE ATT&CK T1528 – Steal Application Access Token","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1176 – Browser Extensions \u002F Plugins","GDPR Article 32 – Security of Processing",{}]