UNC5976

Three Russia-nexus espionage clusters compromise European diplomats and academics without malware — by talking targets through app passwords, device-code approvals and WhatsApp device-linking, all of which are legitimate features working as designed

Google Threat Intelligence Group published research on 2026-08-20 covering three suspected Russia-nexus espionage clusters that share a method rather than infrastructure: they compromise accounts by driving legitimate authentication features, not by delivering malware (Google Threat Intelligence Group, 2026-08-20). The reported target set puts this constituency inside the blast radius directly — "individuals working in academia, aerospace and defense, governments and think tanks across Europe", alongside US academia and think tanks. GTIG assesses with high confidence that all three possess a Russian nexus, and with moderate confidence that two of them are sub-clusters of the actor it tracks as ICE RELIC — the cluster more widely known as Midnight Blizzard — handling initial access.

Application passwords (UNC6293). An application-specific password is an account-level passcode issued so that a legacy client can authenticate without going through the second factor. The cluster sends a diplomatic or conference-themed lure — a PDF containing screenshots that walk the target through creating a password under a specific, official-looking name and sharing it back. Nothing is exploited and no code runs; the victim performs the whole operation, and the resulting credential is designed not to prompt for a second factor. Campaigns are deliberately small, typically fewer than five targets at a time. By mid-2026 the cluster had added a variation asking targets to share a verification code or post-login URL after authenticating legitimately to an external provider.

Device codes and WhatsApp linking (UNC7005, tracked here as Storm-2945, the cluster behind the CaptiveCrunch hospitality-WiFi captive-portal activity). The device-code flow exists so that input-constrained devices can authenticate: one device shows a short code, the user approves it on another. Phished, it becomes a way to have the victim authorise the attacker's session. This cluster delivers those prompts through emailed links to domains impersonating real conferences — GTIG documents a spoof of a European security forum reusing a template from an earlier embassy-invitation operation — and the pages fingerprint the browser with client-side JavaScript to detect automated scanners and headless browsers, withholding the code entirely until the visitor looks like a real person. That last detail matters operationally: a security team detonating the link in a sandbox may see a benign page.

The WhatsApp technique is the same idea applied to a messaging platform. The page asks for the target's phone number, the attacker's backend uses it to generate a genuine device-linking request, and the resulting code is displayed to the victim with instructions to approve it — linking the attacker's device to the victim's account through the vendor's own supported mechanism. The page then offers a voice call, encrypted chat or file share; if the victim joins the call, browser JavaScript captures microphone and camera through the standard media-capture interface and uploads the recording while the call is presented as having failed.

OAuth token harvesting (UNC5976). Assessed as operationally distinct from the other two, this cluster buys file-sharing-themed domains, creates a cloud project for each, and serves a fake file-share login. A target choosing to continue with their existing identity provider is sent through a genuine consent flow and then redirected to the attacker's own cloud-project URL, where a script captures the resulting token. GTIG disrupted the operation by disabling the malicious cloud projects; the cluster stood up at least twelve new domains within roughly three months and began moving hosting elsewhere. It has separately distributed a malicious spreadsheet plugin GTIG names HEADRUSH, observed in April 2026 and leading to an HTML Application downloader — a scripted payload executed through the built-in Windows host binary rather than as a conventional executable — delivered through a domain impersonating a Ukrainian research institute.

Detection concepts, telemetry class first. The unifying property is that none of this produces endpoint malware telemetry on the way in — the compromise completes in the identity plane, so that is where it must be caught. In identity and sign-in telemetry: creation of an application-specific password, which for most organisations should be a rare or extinct event and is trivially alertable; completion of a device-code authorisation, particularly where the approving session and the resulting access originate from different networks or geographies; and new OAuth consent grants to applications outside an approved inventory. In mail and web telemetry, conference-themed invitations linking to newly registered lookalike domains are the delivery pattern, though the browser fingerprinting means automated detonation may return a clean verdict — treat a link that renders differently for a sandbox than for a user as suspicious in itself rather than as a false positive. On the messaging side, the observable is the account's own linked-device list, which is user-visible and rarely inspected.