Russian Clusters Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Learn: Describes a novel technique where threat actors weaponize legitimate OAuth device-authorization flows and WhatsApp multi-device linking to hijack accounts without traditional phishing; no patch exists but worth reviewing whether your OAuth app consent and device-link flows have anomaly logging enabled.
SOC/IR — Plan: Three named Russian espionage clusters are running active campaigns against academia, defense, and government targets using legitimate auth flows — build or tune detections for unusual OAuth device-code grant activity and unauthorized WhatsApp device registration events, and prioritize coverage if your org is in a targeted sector.
Leader — Learn: Nation-state espionage clusters are persistently targeting academia, aerospace/defense, government, and think tanks in the US and Europe; useful context for sector-specific threat briefings but no immediate leadership action is defined without disclosed IOCs or confirmed victim organizations.

Account-Hijacking on CuraSec