Google says multiple suspected Russia-linked espionage clusters targeted academics, government, and defense-related personnel by abusing legitimate sign-in features instead of using obvious fake login pages. The campaigns used realistic lures (file sharing, conference invites, and “secure WhatsApp” communications) to trick targets into handing over OAuth tokens or linking WhatsApp to an attacker-controlled device, enabling account takeover.
Google identified three suspected Russia-linked espionage clusters, UNC6293, UNC7005, and UNC5976, that abused legitimate authentication flows rather than relying only on obvious fake login pages. UNC5976 registered domains resembling file-sharing services and hosted fake file-sharing pages with a "Continue with Google" button. Clicking it sent victims through the real Google OAuth login page, and scripts hosted in cloud infrastructure then stole the authentication token from the redirect URL.
UNC7005 took a different approach, spoofing WhatsApp pages that displayed a legitimate QR code and linking instructions, convincing targets to link their WhatsApp account to a device controlled by the attacker. Once linked, victims received further prompts to join a call, chat, or accept a file, extending the compromise. The same cluster also spoofed a summit site referencing a resolution in support of Ukraine, pushing victims toward a malicious companion app download.
These campaigns worked because each step used a real, trusted service, an actual Google sign-in page, an authentic WhatsApp linking code, or a plausible event invitation. None of the individual actions looked like classic phishing. Targets were academics, diplomatic and government affairs staff, defense and aerospace personnel, and think tank employees, groups often accustomed to receiving file-sharing links, conference invitations, and secure communication requests as part of normal work.
Organizations in academia, government, defense, and nonprofit sectors should train staff to treat OAuth prompts on unfamiliar sites as a red flag, even when the sign-in screen itself is genuinely Google's. Any request to link a messaging app to a new device should be verified through a separate, trusted channel before acting. Staff should also be reminded that sharing a verification code or a post-login URL with anyone, regardless of the reason given, can hand over full account access. Building this awareness helps close the gap that legitimate-looking authentication flows can otherwise exploit.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Groups like UNC5976 sent victims through the real Google OAuth login via a fake file-sharing site, then captured the authentication token from the redirect URL instead of harvesting a password directly.
UNC7005 spoofed WhatsApp pages that displayed a legitimate QR or linking code, tricking targets into linking their WhatsApp account to an attacker-controlled device.
Academics, government affairs and diplomatic staff, defense and aerospace personnel, and nonprofit or think tank workers were among the targeted groups.
Google observed attackers asking targets to share the full post-login URL or a verification code, which alone can let attackers access the account even after a legitimate sign-in.
Imagine this: you tap a real Google login… and that’s exactly how UNC5976 walks into your account. Their fake file-sharing page sends you through real Google OAuth, then scripts grab your token from the redirect URL, no fake password box, just stolen access. Same play with WhatsApp: a spoofed ‘secure WhatsApp call’ page walks you through linking, but the QR actually connects your WhatsApp to their device, then pushes chats and file prompts. Here’s the move: any unfamiliar site asking you to 'Continue with Google' or link WhatsApp from a link, stop, close it, and open the service yourself from your own bookmark or app instead.
Google says three suspected Russian espionage clusters are targeting academics, think tanks, diplomats, and related nonprofit staff by abusing legitimate login and verification workflows that may not look like “classic phishing.” The campaigns include app-password scams, OAuth/device-code tricks,…
Google says three suspected Russian cyber-espionage groups are running highly targeted phishing campaigns against people in government, academia, defense, and think tanks in the US and Europe. A key theme is abusing legitimate Google/Microsoft OAuth login flows so the outreach looks real, tricking…
This weekly roundup highlights multiple real-world social engineering threats, including fake IT help-desk phone calls that push employees to phishing sites to steal passwords and one-time authentication codes. It also describes credential-phishing sites impersonating WhatsApp and Instagram that…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
Researchers showed how a malicious web page could trick OpenAI’s Atlas AI-enabled browser into taking actions a user didn’t intend, like spamming WhatsApp contacts or modifying an Amazon account. The attacks used prompt-injection style instructions hidden in a seemingly legitimate “newsletter…
A threat landscape report describes how criminals now buy or rent phishing, fraud, malware, and hidden infrastructure “as a service,” making scams faster to launch and harder to stop. The article highlights practical, repeatable social-engineering workflows such as fake CAPTCHA pages that trick…
