INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Russian Hackers Abuse Google OAuth to Hijack WhatsApp Accounts

| 2026-08-20 14:00 CRITICAL HIGH STATE-SPONSORED & ESPIONAGE CYBERATTACK (GENERAL)
JSON
Executive Summary
AI-generated
On August 20, 2026, suspected Russian hackers were found to be abusing Google OAuth and WhatsApp to hijack accounts. The threat actor behind this attack is believed to be a group tracked under the moniker UNC7005, also known as Cozy Bear. This cyber espionage cluster has been targeting individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as those within the US, with an estimated 12 targeted countries including Ukraine and Armenia. The attack works by using sophisticated social engineering tactics to compromise personal accounts across multiple platforms through persistent, adaptive phishing campaigns. As of now, Google has disrupted most of UNC5976's infrastructure but it is unclear if this will prevent further attacks from UNC7005.
Technical Mitigations AI-generated
• Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Restrict Web-Based Content (ATT&CK mitigation for Phishing): Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider bloc • User Training (ATT&CK mitigation for Social Engineering): Reduces success of phishing/vishing/impersonation and modern “human interface” lures. • Audit (ATT&CK mitigation for Social Engineering): Enables correlation of email/identity/SaaS/endpoint activity that appears legitimate.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
2c7f41••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
APT29APT29
Target & Sectors
EUROPE EUROPE CIS CIS technologytechnology aerospaceaerospace defensedefense
Incident Timeline
‎April 2026
Threat actors using UNC6293 and UNC7005 campaigns, with distinct differences from UNC5976, targeted individuals of interest in academia, NGOs, diplomacy, defense, Ukraine, Armenia, and other regions.
organisation HTML Application
In April 2026, GTIG observed a HEADRUSH sample ( 2c7f4165967d6f7737b3fef87959846920b57a5368b531ad1427c7214d4c41a2 ) that ultimately led to an HTML Application (HTA) downloader.
organisation HTA
In April 2026, GTIG observed a HEADRUSH sample ( 2c7f4165967d6f7737b3fef87959846920b57a5368b531ad1427c7214d4c41a2 ) that ultimately led to an HTML Application (HTA) downloader.
organisation Distinct
Distinct, but noteworthy: UNC5976 UNC5976 remains distinct from the UNC6293 and UNC7005 clusters, potentially reflecting differing strategic mandates and potential alignment with alternative Russian intelligence services.
organisation UNC6293
Distinct, but noteworthy: UNC5976 UNC5976 remains distinct from the UNC6293 and UNC7005 clusters, potentially reflecting differing strategic mandates and potential alignment with alternative Russian intelligence services.
organisation OPSEC
As such, UNC6293 and UNC7005 share operational methodologies but operate different infrastructure and tolerate different thresholds of OPSEC.
organisation OAuth
In specific scenarios, to protect users from deceptive apps, we display a warning “unverified app” screen before showing users the OAuth consent screen for authentication for unverified, testing mode cloud projects with permissions scopes considered sensitive.
organisation Advanced Protection Program
High-risk users should consider Google’s enhanced security resources such as the Advanced Protection Program (APP).
organisation APP
High-risk users should consider Google’s enhanced security resources such as the Advanced Protection Program (APP).
organisation App Specific Passwords
Enterprise customers of Google Cloud can disable App Specific Passwords by restricting 2-Step verification to “Only Security Keys” or enrolling users into the Advanced Protection Program .
organisation GTI Collection
To assist the wider community in hunting and identifying activity outlined in this blog post, we have included indicators of compromise (IOCs) in a GTI Collection for registered users.
‎between 2021 and 2024
Threat actors, affiliated with UNC6293 and UNC7005, used phishing tactics similar to older attributed ICE RELIC operations between 2021 and 2024.
tactic Phishing
While these operations often appear unique on the surface, several high-level TTPs used by UNC6293 and UNC7005 harken back to older, attributed ICE RELIC phishing operations between 2021 and 2024.
‎2026/08/20
Threat actors, including distinct clusters of Russia's authentication-focused cyber espionage operations (e.g., UNC5976 and UNC7005), have used legitimate features and infrastructure to target multiple types of authentication using phishing campaigns.
organisation Distinct Clusters Target Individuals of Interest
Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia.
organisation Leverage Safety
…for “linked devices” on both corporate and personal devices  Leverage Safety numbers/codes to validate users via off platform communication channels  Outlook and Implications These clusters of Russia’s authentication-focused cyber espionage operations target multiple types of authentication using legitimate features and infrastructure, ranging from app passwords to device linking.
organisation Outlook and Implications
…for “linked devices” on both corporate and personal devices  Leverage Safety numbers/codes to validate users via off platform communication channels  Outlook and Implications These clusters of Russia’s authentication-focused cyber espionage operations target multiple types of authentication using legitimate features and infrastructure, ranging from app passwords to device linking.
organisation Google
GTIG now assesses that UNC5976 is migrating away from Google infrastructure to other providers to host part of their phishing infrastructure.
organisation Anthropic, Black Lotus Labs at Lumen Technologies
Acknowledgements We would like to thank partners across the industry for their collaboration in helping to track and disrupt parts of these operations, including but not limited to our partners at Anthropic, Black Lotus Labs at Lumen Technologies, Microsoft Threat Intelligence Center (MSTIC), and the Polish Military Counterintelligence Service (SKW) and WhatsApp.  Indicators of Compromise (I…
organisation the Polish Military Counterintelligence Service
Acknowledgements We would like to thank partners across the industry for their collaboration in helping to track and disrupt parts of these operations, including but not limited to our partners at Anthropic, Black Lotus Labs at Lumen Technologies, Microsoft Threat Intelligence Center (MSTIC), and the Polish Military Counterintelligence Service (SKW) and WhatsApp.  Indicators of Compromise (I…
organisation WhatsApp
Acknowledgements We would like to thank partners across the industry for their collaboration in helping to track and disrupt parts of these operations, including but not limited to our partners at Anthropic, Black Lotus Labs at Lumen Technologies, Microsoft Threat Intelligence Center (MSTIC), and the Polish Military Counterintelligence Service (SKW) and WhatsApp.  Indicators of Compromise (I…
infrastructure Windows
…also said to have augmented its tradecraft with commodity infostealers like Vidar and Atomic (aka AMOS) to siphon data from Windows and macOS hosts to target U.S.-based academics, diplomats, and researchers focused on Russia and former Soviet state…
infrastructure Macos
…have augmented its tradecraft with commodity infostealers like Vidar and Atomic (aka AMOS) to siphon data from Windows and macOS hosts to target U.S.-based academics, diplomats, and researchers focused on Russia and former Soviet states with pushi…
infrastructure Microsoft 365
…is a PowerShell-based infostealer that's used to steal browser session cookies by getting Chrome's app-bound encryption ( ABE ) protections, saved passwords, Microsoft 365 Single Sign-On (SSO) tokens, and Wi-Fi credentials from compromised systems.
threat_actor APT29
UNC6293, first detailed by the tech giant and the Citizen Lab in June 2025, is assessed to be a sub-cluster of Ice Relic (formerly APT29), which is also tracked under the monikers Cozy Bear and Midnight Blizzard.
infrastructure 12 new domains
The threat actor is estimated to have created no less than 12 new domains and related infrastructure since March 2026, all of which have since been disrupted by Google.
infrastructure 70 victim IP addresses
CaptiveCrunch Likely Targets MSPs Telemetry data from Lumen has identified approximately 70 victim IP addresses, out of which 40 unique IPs sent DNS requests to the C2s associated with CaptiveCrunch.
infrastructure 40 unique IPs
CaptiveCrunch Likely Targets MSPs Telemetry data from Lumen has identified approximately 70 victim IP addresses, out of which 40 unique IPs sent DNS requests to the C2s associated with CaptiveCrunch.
infrastructure 30 unique IP addresses
Another 30 unique IP addresses have been found to communicate with the threat actor's AitM infrastructure to harvest tokens, while a single IP address was observed interacting with the ChocoShell C2 server.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
…also said to have augmented its tradecraft with commodity infostealers like Vidar and Atomic (aka AMOS) to siphon data from Windows and macOS hosts to target U.S.-based academics, diplomats, and researchers focused on Russia and former Soviet state…
Metrics
infrastructure
‎Macos
Affected Product
…have augmented its tradecraft with commodity infostealers like Vidar and Atomic (aka AMOS) to siphon data from Windows and macOS hosts to target U.S.-based academics, diplomats, and researchers focused on Russia and former Soviet states with pushi…
Metrics
infrastructure
‎Microsoft 365
Affected Product
…is a PowerShell-based infostealer that's used to steal browser session cookies by getting Chrome's app-bound encryption ( ABE ) protections, saved passwords, Microsoft 365 Single Sign-On (SSO) tokens, and Wi-Fi credentials from compromised systems.
Metrics
infrastructure
12
New Domains
The threat actor is estimated to have created no less than 12 new domains and related infrastructure since March 2026, all of which have since been disrupted by Google.
Metrics
infrastructure
70
Victim Ip Addresses
CaptiveCrunch Likely Targets MSPs Telemetry data from Lumen has identified approximately 70 victim IP addresses, out of which 40 unique IPs sent DNS requests to the C2s associated with CaptiveCrunch.
Metrics
infrastructure
40
Unique Ips
CaptiveCrunch Likely Targets MSPs Telemetry data from Lumen has identified approximately 70 victim IP addresses, out of which 40 unique IPs sent DNS requests to the C2s associated with CaptiveCrunch.
Metrics
infrastructure
30
Unique Ip Addresses
Another 30 unique IP addresses have been found to communicate with the threat actor's AitM infrastructure to harvest tokens, while a single IP address was observed interacting with the ChocoShell C2 server.
Intelligence Sources
The Hacker News 2026-08-20
Mandiant 2026-08-20