FBI Links Signal and WhatsApp Account-Hijacking Campaigns to Russian Intelligence

Summary

The FBI attributes phishing campaigns targeting Signal and WhatsApp to Russian intelligence-linked actors and says thousands of accounts were compromised. Attackers use verification-code and QR-code lures to link their own devices; the apps’ encryption was not broken.

Key points

The FBI attributed campaigns targeting Signal and WhatsApp to Russian intelligence-linked actors.
The FBI says thousands of accounts worldwide were compromised, with high-value individuals among the targets.
Phishing messages often impersonate platform support and trick users into sharing verification codes or scanning malicious QR codes.
The lures link attacker-controlled devices to victims’ accounts, enabling message monitoring, impersonation, and further phishing.
The FBI says the activity does not break end-to-end encryption and does not exploit vulnerabilities in the messaging apps.
Dutch and French authorities have also warned about similar account-hijacking tactics.

Article Details

Event Type: Phishing and account-hijacking campaigns targeting Signal and WhatsApp, publicly attributed by the FBI to Russian intelligence-linked threat actors.
Impact: The campaigns have compromised thousands of accounts worldwide, primarily targeting people with access to sensitive information. Attackers can read messages and contact lists, impersonate victims, join group chats, and conduct follow-on phishing. The reported access comes from tricking users into sharing verification codes or linking attacker-controlled devices; the article says encryption was not broken and no vulnerabilities were exploited.