Russian cyber-spy groups reportedly abuse OAuth flows in targeted phishing campaigns against aerospace and government sectors

Russian cyber-espionage groups have incorporated OAuth abuse into their phishing campaigns, marking a tactical shift from traditional credential harvesting. By leveraging legitimate authentication flows, attackers reduce the likelihood of detection by security tools that flag suspicious login pages. The method relies on victims unknowingly granting permissions via OAuth verification codes, which provide persistent access to email and cloud accounts without requiring passwords. This approach is particularly effective against targets in aerospace, defense, and government sectors, where multi-factor authentication is common but may not protect against OAuth token misuse.

The campaigns are highly targeted, with fewer than 100 individuals per operation and under 10 confirmed victims. This suggests the groups prioritize stealth and long-term access over broad-scale attacks. Google’s tracking of three distinct groups, UNC6293, UNC7005, and UNC5976, indicates a coordinated effort with varying levels of sophistication. UNC6293, linked to APT29 (Cozy Bear), has been active for nearly two years, while UNC7005 exhibits lower operational security and relies on malware deployment. The reuse of phishing templates, such as spoofed diplomatic event invitations, demonstrates a pattern of exploiting predictable human behavior in high-stakes environments.

For engineers and security teams, the shift to OAuth abuse complicates detection and response. Traditional phishing indicators, like fake login pages, are absent, and the attack surface expands to include any service supporting OAuth. The campaigns also highlight the risks of public Wi-Fi networks, where attackers have deployed captive portals to deliver malware. Mitigation requires user education on OAuth permissions, monitoring for unusual token grants, and enforcing strict conditional access policies. The ongoing nature of these campaigns suggests they will persist, with attackers likely refining their tactics to evade detection further.