Russian Clusters Weaponize OAuth and WhatsApp Flows to Hijack Espionage Targets
Three suspected Russian espionage clusters, including an Ice Relic/APT29-linked crew, are weaponizing legitimate Google OAuth and WhatsApp linking flows to hijack accounts. Campaigns stay tiny, under five victims at a time, and work by popping a real "Continue with Google" dialog inside fake file-sharing pages so targets hand over the OAuth token themselves after signing in. Victims span academia, aerospace/defense, government, and think tanks across Europe and the U.S. Google has disrupted 12 new domains, pushing the actors toward other hosting providers.