Google Details OAuth and WhatsApp Phishing by Suspected Russian Clusters
Summary
Google and other researchers describe suspected Russian clusters using OAuth, app-password and WhatsApp device-linking lures, alongside infostealers and malware, to steal tokens and expand access across academia, defense and government targets.
Key points
- Google attributes the activity to suspected Russian clusters UNC6293, UNC5976 and UNC7005, targeting people in academia, defense, government and think tanks.
- UNC5976 used fake file-sharing pages to route targets through legitimate Google OAuth and collect authentication tokens; Google says it disrupted at least 12 related domains.
- UNC7005 used phishing for OAuth and device-code authentication, and WhatsApp lures that tricked targets into linking an attacker-controlled device.
- The WhatsApp pages offered follow-on calls, chats or downloads; joining a call could trigger JavaScript that recorded audio and video, according to the report.
- Researchers say UNC7005 also used Vidar and Atomic infostealers. Separate CaptiveCrunch activity involved DNS manipulation and phishing infrastructure, with CornFlake RAT and ChocoShell among the reported payloads.
- Microsoft described FruitStone as a web-based command-and-control panel for managing endpoints and campaign payloads. Lumen reported telemetry from victim IPs and raised the possibility of compromised MSPs; that supply-chain scenario remains a possibility, not a confirmed finding.
- UNC5976's HEADRUSH Excel plugin was reported to deliver an HTA; the article says a possible target was identified, but the infection's full scope is unknown.
Article Details
- Attack Vectors
- App-password phishing using diplomatic or conference-themed lures.
- OAuth phishing that redirects victims through legitimate sign-in flows and steals authentication tokens.
- Fake file-sharing pages with pop-up login prompts and malicious scripts hosted on cloud projects.
- Device-code phishing targeting Microsoft accounts.
- WhatsApp phishing that tricks targets into linking their accounts to an attacker-controlled device.
- Phishing emails linking to spoofed event pages or malicious download prompts.
- Infostealer deployment to collect data from Windows and macOS hosts.
- Captive Wi-Fi portal and DNS manipulation used to redirect traffic through attacker-controlled infrastructure.
- Adversary-in-the-middle phishing that abuses Microsoft Entra ID device-code authentication.
- Malware disguised as browser or operating-system updates, including delivery through a ClickFix lure.
MITRE ATT&CK
T1005 · Data from Local SystemCornFlake RAT collects files, while Vidar and Atomic are used to siphon data from Windows and macOS hosts.T1041 · Exfiltration Over C2 ChannelThe WhatsApp phishing flow sends recorded audio and video to a C2 endpoint; the reported malware operations also siphon collected data.T1056.001 · KeyloggingCornFlake RAT collects keystrokes from infected systems.T1059.001 · PowerShellChocoShell is a PowerShell-based infostealer deployed in the CaptiveCrunch activity.T1059.007 · JavaScriptJavaScript on the WhatsApp phishing page recorded audio and video and sent the recordings to a C2 endpoint.T1082 · System Information DiscoveryCornFlake RAT performs system enumeration on infected systems.T1113 · Screen CaptureFruitStone's C2 panel is used to review collected screenshots from compromised endpoints.T1123 · Audio CaptureCornFlake RAT conducts audio surveillance, and the WhatsApp phishing flow could trigger audio recording.T1125 · Video CaptureCornFlake RAT conducts video surveillance, and the WhatsApp phishing flow could trigger video recording.T1528 · Steal Application Access TokenUNC5976 and UNC7005 used OAuth phishing and malicious cloud-project scripts to obtain authentication tokens.T1539 · Steal Web Session CookieChocoShell steals browser session cookies, and the campaigns also obtain authentication tokens for account access.T1555.003 · Credentials from Web BrowsersChocoShell steals saved passwords and browser session cookies from compromised systems.T1557 · Adversary-in-the-MiddleCaptiveCrunch activity used an adversary-in-the-middle position to redirect traffic and conduct device-code phishing.T1566.002 · Spearphishing LinkThe clusters sent targeted phishing emails containing links to attacker-controlled sites and spoofed event or file-sharing pages.T1583.001 · DomainsUNC5976 purchased domains for fake file-sharing pages, and UNC7005 registered domains spoofing the Finnish Operations Center.
People
Threat Actors
Cozy BearThe article identifies Cozy Bear as a tracking name for Ice Relic, which it describes as a cyber-espionage group.ICE RELICThe article describes Ice Relic as a cyber-espionage group and assesses UNC6293 as its sub-cluster; it also says Ice Relic was formerly called APT29 and is tracked as Cozy Bear and Midnight Blizzard.Midnight BlizzardThe article identifies Midnight Blizzard as a tracking name for Ice Relic, which it describes as a cyber-espionage group.Storm-2945A suspected cyber-espionage cluster reported to conduct app-password, device-code, WhatsApp, and OAuth phishing, and to use infostealers; the article also calls it Storm-2945.UNC5976A suspected cyber-espionage cluster reported to use OAuth phishing, fake file-sharing pages, cloud infrastructure, and the HEADRUSH plugin to deliver an HTA.UNC6293A suspected cyber-espionage cluster conducting app-password and OAuth phishing; it is assessed to be a sub-cluster of Ice Relic.
Malware
ATOMICUNC7005 ran WhatsApp, Microsoft, and Google phishing campaigns and used infostealers like Vidar and Atomic.ChocoShell#UNC6293CornFlake RATThis can either lead to the deployment of a Go-based remote access trojan called CornFlake RAT or a PowerShell payload dubbed ChocoShell (aka CHERRYPIE) that’s delivered via a ClickFix lure.VidarUNC7005 ran WhatsApp, Microsoft, and Google phishing campaigns and used infostealers like Vidar and Atomic.
Vendors
Products
ExcelIn addition, UNC5976 has been observed leveraging a rogue Excel plugin codenamed HEADRUSH that’s used to deliver an HTML Application (HTA) downloaded.Google Chromethe other hand, is a PowerShell-based infostealer that’s used to steal browser session cookies by getting Chrome’s app-bound encryption (ABE) protections, saved passwords, Microsoft 365 Single Sign-On (SSO) tokens, andGoogle CloudUpon successful authentication, the victim is sent to a Google Cloud project URL that hosts malicious scripts designed to retrieve the authentication token from the URL and stage it for later use.macOStradecraft with commodity infostealers like Vidar and Atomic (aka AMOS) to siphon data from Windows and macOS hosts to target U.S.-based academics, diplomats, and researchers focused on Russia and former SovietMicrosoft 365 Apps for Enterprisebrowser session cookies by getting Chrome’s app-bound encryption (ABE) protections, saved passwords, Microsoft 365 Single Sign-On (SSO) tokens, and Wi-Fi credentials from compromised systems.Microsoft Entra ID(AitM) phishing operations that abuse the device code authentication flow in Microsoft Entra ID,” Microsoft noted.Microsoft Windowsits tradecraft with commodity infostealers like Vidar and Atomic (aka AMOS) to siphon data from Windows and macOS hosts to target U.S.-based academics, diplomats, and researchers focused on Russia and formerWhatsAppTheir campaigns span app password, OAuth, device code, and WhatsApp phishing, along with malware and token theft to hijack accounts and expand access.
Tools
Countries
Industries
AcademiaUNC5976, and UNC7005, have been using legitimate authentication flows and social engineering to target academia, defense, governments, and think tanks across Europe and the U.S.Aerospace and defenseleveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S.Defense and securityspoofing the legitimate Finnish Operations Center (FOC), which supports Finnish companies in the defense and security markets, specifically in the context of the North Atlantic Treaty Organization (NATO).”Managed service providersof the same campaign has raised the possibility that the threat actor compromised several Managed Service Providers (MSPs), then abused the trust relationship with their clients in a supply chain attack.Think tankslegitimate authentication flows and social engineering to target academia, defense, governments, and think tanks across Europe and the U.S.