# Russian Espionage Groups Are Weaponizing the Login Page You're Supposed to Trust
The most dangerous phishing attack isn't one that fakes a login page. It's one that sends you to the real one.
That's the core insight buried in Google's Threat Intelligence Group report published today, which documents three distinct Russian cyber espionage clusters systematically abusing Google OAuth, application-specific passwords, and WhatsApp's device-linking flow to compromise accounts belonging to diplomats, aerospace researchers, academics, and NGO workers across Europe and the US. The attackers aren't breaking authentication. They're riding it.
## Three Groups, One Playbook
GTIG researchers Gabby Roncone and Wesley Shields track the clusters as UNC6293, UNC5976, and UNC7005 — each with its own infrastructure and target profile, but united by the same operational instinct: legitimate credential flows are more convincing than fake ones, and harder for defenders to block.
UNC6293 is the most pedigreed of the three. Google and Citizen Lab first exposed it in June 2025 as a sub-cluster of APT29 — the same group behind the SolarWinds supply chain breach and the 2016 DNC hack, tracked variously as Cozy Bear and Midnight Blizzard. This crew has been running small-footprint phishing operations that impersonate US State Department officials. The lures orbit diplomatic themes, upcoming conferences, and meetings — credible bait for the think tank researchers and government officials they're hunting.
What makes UNC6293 technically distinctive is its OAuth phishing technique: rather than harvesting credentials, operators convince targets to share a verification code or full OAuth callback URL *after completing a legitimate login*. The victim authenticates successfully against Google — the real Google — and then, through social engineering, hands over the code that authorizes attacker access. No fake login page. No suspicious redirect. Just a real authentication flow exploited through human trust.
UNC5976 automates the same basic con at scale. Since at least March 2026, the group has been spinning up file-sharing-themed domains and cloud projects to host phishing pages with a "Continue with Google" button. When a target clicks it, they're sent to the *actual* Google OAuth consent screen. Upon approval, they land on a Google Cloud project URL where malicious scripts silently exfiltrate the authentication token from the redirect URL before it can be used defensively.
Google has disrupted at least 12 domains and their associated infrastructure since March — and tracked UNC5976 pivoting to alternative hosting providers in response. The group also operates a rogue Excel plugin called HEADRUSH that drops an HTML Application payload, distributed via a domain impersonating a Ukrainian research institute. Confirmed or suspected victims include a Ukrainian aerospace and imaging company. The group's geographic concentration on Ukraine and Armenia, combined with its targeting of military and defense industrial base organizations, points to intelligence collection priorities consistent with Russian state tasking.
UNC7005 — tracked by Microsoft as Storm-2945, and identified by GTIG in February 2026 — adds a third vector: WhatsApp's linked devices feature. The mechanism here exploits the QR-code-based flow that WhatsApp uses to authorize a secondary device. Attackers present victims with what appears to be a legitimate linking prompt; scanning it with their phone hands the attacker persistent, real-time access to the victim's WhatsApp account — messages, contacts, and ongoing communications — without triggering any standard account compromise notification.
## Why OAuth Is the New Credential Dump
The shift toward OAuth abuse isn't incidental. It reflects where defenders have gotten stronger.
Password-based phishing has become progressively harder to monetize. MFA adoption has risen across the government and defense sectors these groups target. Credential stuffing against direct login endpoints triggers rate limiting, anomaly detection, and SIEM alerts. But OAuth — the protocol designed to let trusted applications access your account without sharing your password — creates a different kind of attack surface. When an authorization flow completes successfully, it *looks like normal user behavior*, because it largely is.
The same feature that lets you "Sign in with Google" to a legitimate third-party service lets an attacker, armed with a stolen OAuth token or a user-provided verification code, do the same. The authentication was real. The consent, however manufactured, was granted. The access is valid.
## What These Campaigns Have in Common
Strip away the cluster names and infrastructure details, and you're looking at a unified operational doctrine:
---
## HackWire Analysis
The operational picture here is more significant than the individual techniques suggest. What GTIG has documented isn't three separate hacking crews finding novel methods — it's the maturation of a Russian intelligence doctrine that has been evolving since at least the 2016 election interference campaigns.
APT29 and its sub-clusters learned years ago that the most durable access comes not from exploiting vulnerabilities, but from abusing legitimate systems in ways that are structurally difficult to distinguish from normal user behavior. The SolarWinds operation hijacked a trusted software update mechanism. These OAuth campaigns hijack a trusted authentication mechanism. The logic is identical.
The WhatsApp linking vector deserves particular attention because it affects a communication channel most enterprise security teams aren't monitoring. Email has logs, DLP controls, and phishing filters. WhatsApp does not. For diplomats, researchers, and NGO workers who've moved sensitive conversations to encrypted messaging apps specifically to avoid surveillance, a compromised WhatsApp account is a potentially catastrophic intelligence loss — one that may not surface in any enterprise security tooling at all.
The targeting profile also signals where to watch next: academia feeding defense research pipelines, think tanks shaping policy, aerospace contractors with dual-use technology. These are long-term collection targets, not opportunistic ransomware prey. A compromised account in this context may sit quiet for months, providing persistent intelligence access rather than triggering an immediate incident.
For defenders: revoke unused OAuth application grants now. Audit third-party application permissions across Google Workspace. Train high-value targets explicitly on verification code social engineering — this is different from standard phishing awareness and most users don't recognize it as an attack vector. And treat WhatsApp on organization-issued or organization-adjacent devices as an intelligence exposure risk requiring the same hygiene as email.
— *HackWire Editorial*
---
## Related Coverage