Russian‑linked Threat Clusters Hijack Legitimate OAuth Logins to Harvest Credentials
What Happened — Google’s Threat Intelligence team reports that three Russia‑affiliated groups (UNC6293, UNC7005, UNC5976) are abusing genuine Google and Microsoft OAuth flows. Victims are steered through authentic login pages, then attackers capture authentication tokens via malicious redirects, cloud project hijacks, or social‑engineering prompts for verification codes.
Why It Matters for Compliance & Audit Readiness
- The technique sidesteps traditional perimeter defenses, exposing a gap in SOC 2 Access Control monitoring for personal accounts that may still access corporate resources.
- Continuous evidence of OAuth grant activity and strict redirect‑URI controls are essential audit artifacts to demonstrate “least‑privilege” and “monitoring” criteria under the SOC 2 CC6.1 and CC6.2 principles.
Who Is Affected – Academia, aerospace & defense, government agencies, and think‑tanks in Europe and the United States; any organization whose staff use personal Google or Microsoft accounts for work‑related access.
Recommended Actions
- Inventory all OAuth client registrations and enforce a whitelist of approved redirect URIs.
- Enforce MFA on all personal and corporate accounts and require conditional access policies for OAuth grants.
- Augment security‑awareness training with a module on OAuth phishing and verification‑code scams.
- Deploy logging and alerting on OAuth consent events; retain logs as SOC 2 audit evidence.
Technical Notes – Attack vector: phishing‑based OAuth abuse (legitimate Google/Microsoft login → attacker‑controlled redirect or verification‑code request). No CVE; threat relies on social engineering and mis‑use of OAuth’s “grant‑code” flow. Targets personal accounts, creating a visibility gap for enterprise monitoring. Source: DataBreachToday