Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S. These clusters include UNC6293, UNC7005, and UNC5976. "These clusters engage in persistent, adaptive

Report facts: The article describes three suspected Russian cyber espionage clusters (UNC6293, UNC7005, UNC5976) abusing legitimate authentication flows such as Google OAuth and WhatsApp account linking to compromise targeted individuals in academia, aerospace and defense, government, and think tanks in Europe and the U.S. The attackers leverage trusted identity and communication platforms rather than overt malware to gain access to sensitive accounts and data. RealGround analysis: While the campaign is not described as AI-specific, any AI systems or agents that rely on compromised Google or messaging identities, or ingest data from these accounts, inherit the upstream identity and data trust risks. Organizations should treat identity providers and messaging integrations as critical elements of the AI supply chain, hardening SSO/OAuth configurations, monitoring high-risk account linking flows, and incorporating identity-compromise scenarios into AI security readiness and SBOM-style dependency mapping.