Russian Cyber Espionage Groups Exploit Google OAuth and WhatsApp
Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to target individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as in the U.S. These clusters are identified as UNC6293, UNC7005, and UNC5976. Researchers from Google's Threat Intelligence Group (GTIG) reported that these clusters engage in persistent phishing campaigns, utilizing advanced social engineering tactics to compromise personal accounts across various platforms.
UNC6293, first detailed by Google and the Citizen Lab in June 2025, is assessed to be a sub-cluster of Ice Relic, also known as APT29 or Cozy Bear. This group has been linked to a campaign that exploited a Google account feature called application-specific passwords to seize control of victim accounts. Their phishing campaigns are typically small-scale, targeting fewer than five users at a time while impersonating State Department officials. The application names and lures often revolve around diplomatic themes and upcoming conferences.
As of June 2026, Google reported that UNC6293 was conducting OAuth phishing by requesting targets to share verification codes after logging into an external provider. This method allows attackers to access the victim's account once the verification code is provided.
The second group, UNC5976, has been found using OAuth phishing techniques and automating token collection by abusing cloud infrastructure. Active since at least March 2026, this group has purchased domains related to file-sharing and created fake login pages to harvest authentication tokens from victims.
UNC7005, identified in February 2026, primarily targets academia, diplomatic, and nonprofit personnel across Ukraine, Western Europe, and the U.S. This group has conducted device code phishing operations targeting Microsoft and WhatsApp accounts, using phishing emails that embed links to attacker-controlled sites. These sites prompt users to confirm their participation in events, often using themes related to wine preferences, a tactic that has been noted in previous Ice Relic attacks.
In May and June 2026, UNC7005 spoofed WhatsApp to lure targets into linking their accounts with an attacker-controlled device for secure communications. This method allows attackers to record audio and video from the victims' devices during calls.
Additionally, UNC7005 has augmented its tactics with commodity infostealers to siphon data from compromised systems. The group has also been involved in a campaign called CaptiveCrunch, which targets captive Wi-Fi portals to redirect users to attacker-controlled infrastructure for credential theft.
The GTIG's findings indicate that these Russian cyber espionage operations creatively exploit legitimate features to compromise accounts, making it challenging to track both legitimate and malicious access. The combination of these tactics enables quick exfiltration operations and further phishing opportunities from compromised accounts.
