Hackers linked to Russia have found a simple way to steal digital identities: Google OAuth login and WhatsApp links. User trust in these methods is the perfect hook. Without two-step verification, anyone can lose control of their email and social media within minutes, exposing private conversations and personal data to third parties.
The Attack Mechanism: OAuth as a Backdoor 🔐
The attack is based on spoofing OAuth permission requests. The user receives a WhatsApp link that simulates a legitimate Google verification. Upon accepting, an access token is granted to the malicious application without needing a password. This token allows the attacker to read emails, access contacts, and modify security settings. The only effective barrier is two-factor authentication, which requires additional confirmation outside the standard OAuth flow.
Trusting the Blue Google Button: The Lottery You Don't Want to Win 🎲
It turns out that blue Sign in with Google button wasn't as friendly as it seemed. Now it turns out that even your cousin's WhatsApp link can be a Trojan horse in a suit. Meanwhile, we keep using the same password since 2015 for convenience. The irony: we protect our phone more with a fingerprint than our bank account with a two-step key. Good thing the hacker is Russian and in no hurry.