The FBI and CISA have issued an urgent warning about a massive phishing by Russian hackerstargeting Signal and WhatsApp. The cyberattacks aim to compromise thousands of messaging app accounts to gain access to sensitive communications.
According to FBI Director Kash Patel , the campaign targets high-value individuals , including current and former U.S. government officials, military personnel, political figures and journalists. Globally, this effort has led to unauthorized access to thousands of individual accounts.
The phishing attacks do not exploit any security vulnerabilities in the Signal or WhatsApp platforms , but rely on misleading users through social engineering techniques. Attackers pose as “ Signal Support ” and approach victims, tempting them to click on malicious links or provide their PIN or verification code.
See also: Netherlands: Russian hackers breach Signal, WhatsApp accounts of officials
Signal and WhatsApp attack techniques by Russian hackers
The campaign uses two main attack methods with different outcomes for victims. In the first case, if the victim provides the PIN or verification code to the attacker, they lose access to their account, as the attacker uses it to recover the account. While the attacker cannot access older messages, they can monitor new messages and send messages to others impersonating the victim.
In the second method, if the victim clicks on the link or scans the QR code, an attacker's device is linked to the victim's account. This allows hackers to access all messages, including those sent in the past. In this scenario, the victim continues to have access to their account unless they explicitly remove it from the app's settings.
Cybersecurity experts from Germany and the Netherlands have also issued similar warnings. Rear Admiral Peter Reesink, director of the Dutch intelligence agency MIVD, warned that apps like Signal and WhatsApp, despite end-to-end encryption, should not be used for classified or confidential information.
See also: CISA: Spyware campaigns target Signal & WhatsApp users
Connection to Russian threat groups
While authorities did not attribute the activity to a specific threat group, previous reports from Microsoft and Google Threat Intelligence Group have linked such campaigns to multiple Russia-linked threat groups, including Star Blizzard, UNC5792 (also known as UAC-0195), and UNC4221 (also known as UAC-0185).
Cyber Crisis Coordination Center (C4) has also warned of an increase in campaigns targeting instant messaging accounts associated with government officials, journalists and business leaders. These attacks, when successful, can allow malicious actors to access chat history or even take control of victims' accounts.
Protection measures and recommendations
To better protect against this threat, users are urged to never share their SMS or PIN, be cautious when receiving unexpected messages from unknown contacts, check links before clicking, periodically review connected devices , and remove those that look suspicious.
See also: PLUGGYAPE malware targets Ukraine via Signal & WhatsApp
Signal stressed that “attacks phishing, rely on social engineering. Attackers impersonate trusted contacts or services to trick victims into handing over their login credentials or other information.” Cybersecurity experts recommend that organizations train users on how to recognize phishing threats and enforce strict verification for high-value targets.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
