Plan
active
Russian Clusters Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
- Engineer — Learn: Describes a novel technique where threat actors weaponize legitimate OAuth device-authorization flows and WhatsApp multi-device linking to hijack accounts without traditional phishing; no patch exists but worth reviewing whether your OAuth app consent and device-link flows have anomaly logging enabled.
- SOC/IR — Plan: Three named Russian espionage clusters are running active campaigns against academia, defense, and government targets using legitimate auth flows — build or tune detections for unusual OAuth device-code grant activity and unauthorized WhatsApp device registration events, and prioritize coverage if your org is in a targeted sector.
- Leader — Learn: Nation-state espionage clusters are persistently targeting academia, aerospace/defense, government, and think tanks in the US and Europe; useful context for sector-specific threat briefings but no immediate leadership action is defined without disclosed IOCs or confirmed victim organizations.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.