Reported by 2 outlets

Timeline

1. original reporting

   Russian Hackers Trick Academics and Diplomats Into Giving Them Access to Email and WhatsApp

   cyberpress.org · 53d ago · August 21st, 2026

   Google Threat Intelligence Group (GTIG) has uncovered three suspected Russian cyber-espionage clusters targeting academics, diplomats, defense staff, government personnel, and think-tank researchers in Europe and the United States. The groups UNC6293, UNC7005, and UNC5976 abuse legitimate account-authentication features to steal access to email, Microsoft 365, Google, and WhatsApp accounts. The campaigns rely on convincing social-engineering lures rather than obvious malicious attachments. Attackers impersonate trusted organizations, including the U.S. State Department , conference organizers, Microsoft services, WhatsApp, and defense-sector entities. Their invitations commonly refer to diplomatic meetings, security events, file sharing, or private calls. UNC6293, assessed with moderate confidence as connected to the Russia-linked ICE RELIC cluster, has used application-specific password phishing since 2025. It persuaded targets to create app passwords with names such as “ms.state.gov” and submit the generated passcode. That allows an attacker to access a mailbox without repeatedly requesting the victim’s normal password or two-factor authentication code. Google previously observed the group targeting prominent academics and critics of Russia through tailored State Department-themed correspondence. Russian Hackers Breach Diplomat Accounts UNC7005, also tracked as STORM-2945, expanded this approach with Microsoft device-code phishing and WhatsApp device-linking scams. Victims

2. update from gbhackers.com

   Russia-Linked Hackers Exploit Legitimate Login Flows to Bypass 2FA and Steal Account Access

   gbhackers.com · 53d ago · August 21st, 2026

   Rather than relying solely on credential-harvesting pages, the operators manipulate users into completing genuine app-password, OAuth, device-code, and device-linking workflows that can hand attackers authenticated […] The post Russia-Linked Hackers Exploit Legitimate Login Flows to Bypass 2FA and Steal Account Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .