Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics

Google TAG tracked three Russia-linked espionage clusters (UNC6293, UNC7005, UNC5976) that target researchers, diplomats and defense-sector personnel by abusing legitimate authentication flows—app passwords, OAuth/device-code phishing, and WhatsApp linking—to obtain access tokens and deploy commodity and custom infostealers (VIDAR, ATOMIC, CHERRYPIE, HEADRUSH) and additional tooling; operations span conference-themed lures, captive-portal redirects at hotels, and cloud-hosted phishing infrastructure, and Google recommends revoking unknown app passwords, checking linked devices, treating unsolicited OAuth prompts as suspicious, and considering Advanced Protection for high-risk users.