FBI and CISA: Russian Intelligence Is Hijacking Signal and WhatsApp Accounts at Scale. Thousands Already Compromised.

The Story

On March 20, the FBI and CISA published PSA I-032026-PSA, a joint Public Service Announcement warning that threat actors affiliated with Russian Intelligence Services are conducting phishing campaigns against users of commercial messaging applications, primarily Signal and WhatsApp. FBI Director Kash Patel stated on X that the campaign targets "individuals of high intelligence value, including current and former U.S. government officials, military personnel, political figures, and journalists" and has resulted in "unauthorized access to thousands of individual accounts."

This is the first public US government attribution linking these specific messaging app phishing campaigns directly to Russian intelligence, rather than the broader category of state-sponsored hackers. Prior reporting from Microsoft and Google Threat Intelligence Group attributed similar activity to multiple Russia-aligned threat clusters tracked as Star Blizzard, UNC5792 (UAC-0195), and UNC4221 (UAC-0185).

The FBI emphasized that the attackers have not broken end-to-end encryption and have not compromised Signal or WhatsApp as platforms. Instead, they bypass encryption entirely by stealing access to individual accounts through social engineering. Once inside, the attacker can read the complete message history, view contact lists, send messages as the victim, and launch additional phishing campaigns from a trusted identity.

The phishing techniques are straightforward but effective. Attackers impersonate in-app support accounts using names like "Signal Support," "Signal Security Bot," or "Signal Security ChatBot." They send fake security alerts claiming suspicious login activity and instruct targets to reply with verification codes, share PINs, or scan QR codes. The QR code method is particularly dangerous because it links the attacker's device to the victim's account, giving the attacker access to the complete message history and real-time messages going forward, while the victim continues using their own device unaware.

The warnings are not coming from the US alone. Earlier this month, the Dutch General Intelligence and Security Services (AIVD and MIVD) published an alert describing identical tactics targeting high-value individuals in the Netherlands. On the same day as the FBI PSA, France's Cyber Crisis Coordination Center (C4), part of ANSSI, published its own warning about a surge in attacks targeting messaging accounts of government officials, journalists, and business leaders. Three allied intelligence services issuing concurrent warnings about the same campaign within two weeks is a clear signal that this is an active, large-scale intelligence collection operation.

Russia's interest in Signal specifically is strategic. Dutch intelligence noted that Signal has a "good reputation" as a secure and reliable communication channel among officials who handle sensitive information. Ironically, CISA itself recommended in 2024 that highly targeted individuals use Signal for sensitive communications. The attackers are exploiting exactly that trust.

The Adversary Perspective

From a social engineering standpoint, this campaign is a masterclass in targeting the trust assumptions that users develop around encrypted messaging apps.

The core insight is that encryption protects the channel, not the account. End-to-end encryption means that no one between the sender and recipient can read the message in transit. But if the attacker becomes the recipient by taking over the account or linking a device, encryption works perfectly for them too. They receive every message in plain text, exactly as intended. The encryption is not a defense against account compromise. It never was. But users have been conditioned to believe that "encrypted" means "safe," which creates a false sense of security that makes them less vigilant against phishing.

The QR code device-linking attack is especially effective. Signal and WhatsApp both support linking additional devices to an account via QR code scan. This is a legitimate feature designed for desktop clients and secondary devices. The attacker generates a QR code that, when scanned by the victim, links the attacker's device to the victim's account. The victim's app continues to work normally. There is no notification that seems alarming. But the attacker now receives every message in real time. This is nearly invisible to the victim and can persist until the linked device is manually removed.

The impersonation-to-phishing chain is self-reinforcing. Once an attacker controls a high-value account, they can send phishing messages to everyone in the victim's contact list from a trusted identity. A message from a known colleague or government official asking to "verify" a new security feature carries far more credibility than a random phishing email. Each compromised account becomes a launch pad for the next round of compromise. This is how the campaign scales to thousands of accounts.

Defensive Takeaways