Russia-Linked Groups Abuse Google and Microsoft OAuth Flows to Steal Tokens

Google reported that three separate Russia-linked espionage clusters are abusing legitimate Google and Microsoft authentication flows to steal tokens and account access, targeting defense, government, academic, and think tank organizations.

Why Abusing Legitimate Flows Is Harder to Detect

Attacks that exploit legitimate OAuth authentication flows — rather than a traditional credential-phishing page or malware — are inherently harder to detect, because the traffic pattern looks like normal, expected authentication activity to most monitoring tools. This class of attack (consent phishing, OAuth token theft) has grown as multi-factor authentication has made simple password theft less reliable for attackers, pushing sophisticated actors toward abusing the authentication protocol itself instead.

• Three distinct clusters, not one campaign — suggesting this technique has become a standard part of the toolkit across multiple Russia-linked operations, not a single group's novel approach
• Defense, government, academic, and think tank targeting specifically indicates intelligence-gathering objectives, not financially-motivated cybercrime
• Organizations in these sectors specifically should review OAuth application consent policies and monitor for unusual third-party app authorization requests, not just traditional phishing indicators