{"id":242987,"date":"2026-08-21T01:24:45","date_gmt":"2026-08-21T06:24:45","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/08\/suspected-russian-hackers-abuse-google-oauth-and-whatsapp-linking-to-hijack-accounts"},"modified":"2026-08-21T01:24:45","modified_gmt":"2026-08-21T06:24:45","slug":"suspected-russian-hackers-abuse-google-oauth-and-whatsapp-linking-to-hijack-accounts","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/08\/suspected-russian-hackers-abuse-google-oauth-and-whatsapp-linking-to-hijack-accounts","title":{"rendered":"Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/suspected-russian-hackers-abuse-google-oauth-and-whatsapp-linking-to-hijack-accounts.jpg\"><\/a><\/p>\n<p>Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S.<\/p>\n<p>These clusters include <strong>UNC6293<\/strong>, <strong>UNC7005<\/strong>, and <strong>UNC5976<\/strong>.<\/p>\n<p>\u201cThese clusters engage in persistent, adaptive phishing campaigns, using sophisticated social engineering tactics to compromise personal accounts across multiple platforms,\u201d Google Threat Intelligence Group (GTIG) researchers Gabby Roncone and Wesley Shields <a href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/distinct-clusters-target-individuals-of-interest-to-russia\" target=\"_blank\">said<\/a> in a report published today.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S. These clusters include UNC6293, UNC7005, and UNC5976. \u201cThese clusters engage in persistent, adaptive phishing [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[],"class_list":["post-242987","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/242987","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=242987"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/242987\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=242987"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=242987"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=242987"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}