Google Tracks Russian Cyber Spies Abusing OAuth in Targeted Phishing Campaigns

“so that targets can more readily recognize malicious outreach.” — Google, on why it published details of ongoing campaigns that now abuse OAuth flows.

Google tracking three UNC groups targeting academia, aerospace, defense, government, and think tanks

Google’s Threat Intelligence Group (GTIG) says it is tracking three distinct suspected Russian cyber-spy crews — UNC6293, UNC7005, and UNC5976 — conducting highly targeted phishing, OAuth-abuse, and malware operations against individuals across Europe and the United States. GTIG reports the campaigns have operated since at least last year and remain ongoing, with some phishing and OAuth-abuse operations observed “this month.” The threat-intel team told The Register each campaign had fewer than 100 targets and under 10 victims.

UNC6293: State Department impersonation and the verification-code OAuth trick

GTIG has monitored UNC6293 for nearly two years and describes the group as a suspected APT29-linked phishing squad; the report notes APT29 is “probably best known for the 2020 SolarWinds hack” and that analysts often link it to Russia’s Foreign Intelligence Service (SVR). UNC6293 commonly poses as US State Department employees to lure targets into long-term access to their email. In June 2026, GTIG observed an OAuth phishing variant in which UNC6293 requested targets share “either the full URL or ‘verification code’ after performing a legitimate login to an external provider,” GTIG analysts Gabby Roncone and Wesley Shields wrote. By providing the verification code the target would grant UNC6293 access to the account, GTIG warned.

UNC7005: captive-portal compromise, conference spoofs, and WhatsApp device-code phishing

GTIG asserts, with “moderate confidence,” that UNC7005 is another initial-access crew connected to APT2/Cozy Bear/Ice Relic and the SVR. First identified in February, UNC7005 targets academia, diplomatic, and nonprofit personnel across Ukraine, Western Europe, and the US and combines lower operational security with heavier use of malware. ReliaQuest and Microsoft first raised alarms about the group; Microsoft tracks UNC6293 as Storm-2945, the report notes.

UNC7005 has compromised captive-portal networks in hotels and conference venues to deliver infostealers, keyloggers, and other malware in an AI-assisted operation beginning in February. The crew also conducts device-code phishing for Microsoft and WhatsApp accounts. Recent lures imitate diplomatic event invitations and conference registrations — including a May campaign that spoofed the GLOBSEC forum and reused earlier website templates. GTIG described the registration flow as “thorough,” even featuring an “epicurean wine selection” theme used in previous campaigns. In one wave, victims who clicked to download a “Summit Companion App” instead installed infostealers on macOS and Windows devices.

In May and June, UNC7005 also used WhatsApp spoofs prompting targets to join voice calls or encrypted chats or to download files; joining a voice call could trigger malicious JavaScript that recorded audio and video and uploaded it to attacker command-and-control servers.

UNC5976: fake file-sharing domains, cloud projects, and saved OAuth tokens

GTIG began tracking OAuth-related activity from UNC5976 in March 2026. In GTIG’s observed flow, the group registers several domains themed around file sharing, publishes a fake file-sharing page that prompts users to “Continue with Google,” and links to a legitimate Google OAuth login. After a user authenticates, the flow redirects to a Google Cloud project URL controlled by the attacker, which captures the authentication token. GTIG calls UNC5976 “distinct” from the other crews, noting different strategic mandates, dedicated post-compromise infrastructure rather than residential proxies, and heavier use of malware and tooling in its OAuth operations.

What this means for technologists and for academics, diplomats, and aerospace personnel

• Technologists and security teams: GTIG’s findings underline that attackers are shifting to abuse legitimate OAuth flows and cloud project redirects — detection and response need to include monitoring of third-party OAuth grants, unusual cloud-project redirects, and token storage or exfiltration behaviors tied to cloud URLs.
• Academics, diplomats, think-tank researchers, and aerospace staff: the campaigns are small and highly targeted. GTIG’s timeline and lures — spoofed State Department invites, conference registrations, and file-sharing pages — mean that users in these communities should treat unsolicited calendar invites and event-registration links with extra scrutiny, as Google explicitly warned.

The campaigns Google describes are notable for scale and subtlety: each operation targets relatively few people, yet uses legitimate-looking authentication flows and event lures to harvest persistent access. GTIG observed techniques in active use this month, and its analysts named specific behavioral patterns — verification-code requests, captive-portal compromises, reused conference-site templates, and cloud-project token capture — that defenders can look for now. The record ends on a concrete question: with attackers embedding themselves in legitimate OAuth and cloud workflows, which monitoring and access controls will organizations prioritize to catch tokens and redirects before a targeted compromise turns into long-term account access?

Original story