Russian Hackers Abuse Legitimate Google Auth Features for Phishing Attacks

Russian-linked hackers have been using legitimate authentication features to compromise personal accounts of people in sensitive sectors across Europe and the US, according to Google. The tech giant is tracking three suspected cyber-espionage clusters: UNC6293, UNC7005, and UNC5976, which it assesses with high confidence to have a Russian nexus.

The campaigns abuse legitimate Google OAuth, app-password, and device-linking workflows rather than exploiting software vulnerabilities. UNC7005 has also used WhatsApp device linking to attach attacker-controlled devices to victims' accounts.

Targets include academics, diplomats, defense personnel, government-linked users, and think-tank researchers. Legitimate sign-in pages become phishing traps, with victims encountering genuine authentication pages during these attacks.