U.S. and French Agencies Warn of Russian-Linked Phishing Targeting Signal and WhatsApp
Summary
U.S. and French agencies warn Russian intelligence-affiliated actors are phishing high-value Signal and WhatsApp users. They report thousands of accounts accessed; code theft can seize accounts, while malicious QR links can expose message histories.
Key points
- U.S. agencies say Russian intelligence-affiliated actors have gained unauthorized access to thousands of messaging-app accounts globally; French agencies also warned of a surge in attacks.
- Targets include current and former government officials, military personnel, political figures, journalists, and business leaders.
- Attackers impersonate services such as “Signal Support” to solicit verification codes or PINs, or to persuade targets to click links or scan QR codes.
- Providing a code or PIN can let attackers recover an account, monitor new messages, and impersonate the victim; linking an attacker-controlled device can expose past messages while the victim retains account access.
- The attacks use social engineering and do not exploit flaws in messaging apps’ encryption, according to the agencies.
- Similar campaigns have previously been linked by Microsoft and Google Threat Intelligence Group to Star Blizzard, UNC5792 (UAC-0195), and UNC4221 (UAC-0185); the agencies did not name a specific actor.
- Recommendations include never sharing verification codes or PINs, checking unexpected messages and links, and reviewing linked devices.
Article Details
- Event Type
- Phishing and social-engineering campaign targeting commercial messaging app accounts.
- Impact
- U.S. and French agencies report that thousands of individual accounts have been compromised globally. Attackers may view messages and contact lists, impersonate victims, and conduct further phishing. Sharing a PIN or verification code can enable account recovery and access to new messages; clicking a link or scanning a QR code can link an attacker-controlled device and expose past messages. The campaign does not exploit flaws in the apps’ encryption.
MITRE ATT&CK
People
Threat Actors
Star BlizzardMicrosoft and Google Threat Intelligence Group have linked similar campaigns to this Russia-aligned threat cluster; the agencies did not attribute the reported activity to a specific actor.UNC4221Microsoft and Google Threat Intelligence Group have linked similar campaigns to this Russia-aligned threat cluster; the article identifies UAC-0185 as an alternate name. The agencies did not attribute the reported activity to a specific actor.UNC5792Microsoft and Google Threat Intelligence Group have linked similar campaigns to this Russia-aligned threat cluster; the article identifies UAC-0195 as an alternate name. The agencies did not attribute the reported activity to a specific actor.
Products
Signalthreat actors are running phishing campaigns to compromise commercial messaging apps like Signal and WhatsApp to seize accounts of highâvalue individuals such as officials, military personnel,WhatsAppthreat actors are running phishing campaigns to compromise commercial messaging apps like Signal and WhatsApp to seize accounts of highâvalue individuals such as officials, military personnel, journalists, and
Countries
Francea similar alert, the Cyber Crisis Coordination Center (C4), part of the National Cybersecurity Agency of France (ANSSI), warned of a surge in attack campaigns targeting instant messaging accounts associated withGermanyAs recently alerted by cybersecurity agencies from Germany and the Netherlands, the attack involves the adversary posing as “Signal Support” to approach targets and urge them to click on a link (or alternatively scan aNetherlandsAs recently alerted by cybersecurity agencies from Germany and the Netherlands, the attack involves the adversary posing as “Signal Support” to approach targets and urge them to click on a link (or alternatively scan aRussiaprior reports from Microsoft and Google Threat Intelligence Group have linked such campaigns to multiple Russia-aligned threat clusters tracked as Star Blizzard, UNC5792 (aka UAC-0195), and UNC4221 (aka UAC-0185).United Statesand Signal to seize control of accounts belonging to individuals with high intelligence value, the U.S.
Industries
Businesscampaigns targeting instant messaging accounts associated with government officials, journalists, and business leaders.Governmentgovernment officials, military personnel, political figures, and journalists,” FBI Director Kash Patel said in a post on X.MediaWe also want to emphasize that Signal Support will *never* initiate contact via in-app messages, SMS, or social media to ask for your verification code or PIN.