Three Russian clusters phish the grant, not the password, and MFA completion changes nothing

Multi-factor authentication settles whether the person completing a login is the account holder. Every technique in the Google Threat Intelligence Group report lets that check succeed and takes what the platform issues afterwards. An OAuth consent grant, an application specific password, a device code approval and a linked WhatsApp device are authorization artifacts rather than authentication events. They outlive the session that created them and can be replayed without a password, which is why GTIG says a finished MFA rollout stops none of the three clusters ^[3].

In the UNC5976 flow the target lands on a file sharing page, waits out a short delay, clicks a Continue with Google button and arrives at the genuine Google OAuth page, correct domain, valid certificate. The redirect afterwards lands on a Google Cloud project URL, where scripts strip the authentication token out of the URL and stage it for an operator ^[10]. The victim authenticates, satisfies MFA, and is never asked for a credential on an attacker-owned domain ^[14]. Awareness training built on reading the address bar has nothing to catch ^[14].

The WhatsApp work is harder to defend, because nothing is intercepted at all. According to GTIG, UNC7005 pages spoofing WhatsApp in May and June 2026 asked the target for a phone number, used it to raise a real device link request against an attacker-controlled device, then displayed the QR code and linking code that WhatsApp itself returned, plus instructions for completing the link ^[15][16]. Every string on the screen is authentic. Once the link completes the attacker device receives message traffic, and the page pushes the target toward a voice call, an encrypted chat or a file download; choosing the call runs JavaScript that records audio and video and ships it to a command and control endpoint ^[16][17].

The clusters have also thought about who is watching. GTIG places the targeting on personal accounts across multiple platforms rather than corporate mailboxes ^[4], where no employer holds the sign-in log, and both UNC6293 and UNC7005 route post-compromise activity through commercial residential proxies so the session appears to originate in consumer IP space ^[7]. UNC6293 is assessed as a sub-cluster of Ice Relic, formerly APT29 ^[5]; UNC7005 is the group Microsoft tracks as Storm-2945 ^[6].

Google counted no fewer than 12 new UNC5976 domains and their supporting infrastructure created since March 2026, and disrupted all of them ^[11]. Measured against a report dated 20 August 2026, that is a build rate near two domains a month ^[19], and UNC5976's response to the disruption was to move its phishing pages onto other providers ^[12]. The same cluster runs malware in parallel: HEADRUSH, a rogue Excel plugin found in April 2026 that delivers an HTA downloader, distributed from a domain impersonating a Ukrainian research institute, with indications of use against a Ukrainian aerospace and imaging company whose full infection GTIG says it cannot scope ^[13].

That puts the durable fix on the platform side of the flow, where the grant is minted. A device link request the account holder did not start on their own handset should not be completable from a web page. Short of that, the defender's only move is revocation after the fact, and revocation depends on noticing, which is precisely what the residential proxies are there to prevent ^[7].