Cybersecurity agencies, including CISA and the FBI, have issued a warning about a large-scale phishing campaign targeting users of commercial messaging applications (CMAs) such as WhatsApp and Signal.
The campaign is linked to Russian intelligence-affiliated threat actors and has already resulted in the compromise of thousands of accounts globally.
Who is being targeted?
This is not a typical mass phishing campaign.
Attackers are focusing on high-value individuals, including:
- Government officials (current and former)
- Military personnel
- Political figures
- Journalists
- Business leaders
The goal is clear:
👉 Gain access to sensitive communications and networks of trust
How the attack works
Unlike many cyberattacks, this campaign does not exploit vulnerabilities in WhatsApp or Signal.
Instead, it relies entirely on social engineering.
Victims receive messages claiming:
- Suspicious login activity
- Account security alerts
- Requests from “Signal Support” or similar trusted entities
These messages create urgency and push users to:
- Click on malicious links
- Scan QR codes
- Share verification codes or PINs
Two attack scenarios
1. Verification Code / PIN Theft
If the victim shares a verification code or PIN:
- The attacker takes over the account
- The victim loses access
- The attacker can impersonate the victim and message others
2. Malicious Device Linking
If the victim clicks a link or scans a QR code:
- The attacker links their own device to the account
- Gains access to past and future messages
- The victim may remain unaware and still use the account
👉 This is the more dangerous scenario, as it allows silent surveillance
Why this is dangerous
Once inside an account, attackers can:
- Read private conversations
- Access contact lists
- Send messages as the victim
- Launch secondary phishing attacks using trusted relationships
This turns a single compromise into a chain attack across networks of trust.
A coordinated global campaign
While not officially attributed to a single group, similar activity has been linked to:
- Star Blizzard
- UNC5792 (UAC-0195)
- UNC4221 (UAC-0185)
European agencies, including France’s ANSSI, have also reported a surge in similar attacks targeting high-profile individuals.
How to stay protected
1. Never share verification codes
Messaging apps will never ask for your code or PIN via messages
2. Be cautious with urgent alerts
Security messages creating panic are a common phishing tactic
3. Avoid unknown links and QR codes
Especially those claiming to “secure” or “verify” your account
4. Review linked devices regularly
Check for unknown devices connected to your account and remove them
5. Understand how support works
For example:
👉 Signal never contacts users proactively to request credentials
Key takeaway
This campaign highlights a critical shift:
The biggest threat is no longer breaking encryption — it’s bypassing the user.
Even the most secure platforms can be compromised if attackers successfully manipulate human behavior.
