Russian Hackers Exploit Google OAuth‑WhatsApp Linking

OAuth flows are designed for secure delegated access without exposing passwords, but they can become risky when an application’s implementation is flawed. The new attack uses a “linking” mechanism between Google’s OpenID Connect system and messaging apps such as WhatsApp, adding a surface where session tokens can be hijacked or manipulated. A similar technique was used against LinkedIn users in 2019 with fake mobile app installations that requested excessive permissions from linked accounts using stolen user sessions after initial compromise on another service.

Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging these legitimate authentication flows to target individuals working in academia, aerospace and defense, governments, and think tanks across Europe and the U.S. These clusters include UNC6293, UNC7005, and UNC5976 ¹.

Threat actors often focus on people who manage multiple online identities because shared information at each platform interface point increases exposure before escalating privilege acquisition attempts further into enterprise networks by exploiting compromised personal devices used both privately and professionally within organizational IT ecosystems lacking proper segmentation controls.

The attackers likely use credential stuffing, reusing stolen credentials from one service on others. Targeting aerospace/defense suggests interest in intellectual property or communications, similar to the APT29 group (linked to Russia) that compromised RSA in 2015 for access into defense contractors; expect phishing emails with fake login pages mimicking these services.

Mitigation requires enforcing multi‑factor authentication across all accounts and tightening OAuth flow implementation by limiting permissions granted during linking. Organizations should audit linked accounts regularly and monitor unusual token usage patterns. Users are advised not to grant unnecessary permissions when connecting third‑party apps and to verify app authenticity before authorizing access.