Russian Cyber Espionage Groups Exploit Google OAuth and WhatsApp Linking for Account Hijacking

Russian cyber espionage groups are exploiting Google OAuth and WhatsApp account linking to hijack accounts of individuals in academia, defense, and government sectors. The attacks involve sophisticated phishing techniques, fake domains, and malware to exfiltrate data and compromise devices.

Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S.

These clusters include UNC6293, UNC7005, and UNC5976.

"These clusters engage in persistent, adaptive

Read original article