FBI links Signal phishing attacks to Russian intelligence services
Recorded: March 20, 2026, 9 p.m.
| Original | Summarized |
FBI links Signal phishing attacks to Russian intelligence services News Featured Trivy vulnerability scanner breach pushed infostealer via GitHub Actions Microsoft Azure Monitor alerts abused for callback phishing attacks Musician admits to $10M streaming royalty fraud using AI bots FBI links Signal phishing attacks to Russian intelligence services Varonis Atlas: Securing AI and the Data That Powers It Microsoft Exchange Online service change causes email access issues Block ads and trackers on 9 devices for only $16 in this deal FBI warns of Handala hackers using Telegram in malware attacks Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityFBI links Signal phishing attacks to Russian intelligence services FBI links Signal phishing attacks to Russian intelligence services By Lawrence Abrams March 20, 2026 The FBI has issued a public service announcement warning that Russian intelligence-linked threat actors are actively targeting users of encrypted messaging apps such as Signal and WhatsApp in phishing campaigns that have already compromised thousands of accounts. Two different phishing methods seen targeting SignalSource: FBI Samples of Signal phishing messages used in the phishing campaignSource: France’s Cyber Crisis Coordination Center (C4) Red Report 2026: Why Ransomware Encryption Dropped 38% Related Articles: Device Linking Lawrence Abrams Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories Microsoft: March Windows updates break Teams, OneDrive sign-ins CISA orders feds to patch max-severity Cisco flaw by Sunday Microsoft Azure Monitor alerts abused for callback phishing attacks Sponsor Posts Secure your AI agents without sacrificing speed. Are refund fraud methods targeting your brand? You can monitor the underground for these threats. Cyber resilience without the complexity. Join Zero Networks to stop lateral movement fast. Overdue a password health-check? Audit your Active Directory for free AI is a data-breach time bomb: Read the new report Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
The FBI has issued a public service announcement detailing a sophisticated phishing campaign orchestrated by Russian intelligence services targeting users of encrypted messaging applications, primarily Signal and WhatsApp. This campaign, as highlighted by the FBI, Dutch, and French cybersecurity authorities, doesn’t involve breaking the encryption of these platforms – Signal, WhatsApp, and others – but rather exploits vulnerabilities in user behavior and account security protocols. The core tactic involves hijacking accounts by tricking users into granting access to their accounts through methods such as scanning malicious QR codes or sharing verification codes with seemingly legitimate support accounts. These compromised accounts are then utilized for extensive surveillance, impersonation, and the launch of further phishing schemes. According to the FBI’s assessment, thousands of accounts have been affected globally, primarily targeting individuals of significant value to intelligence agencies, including current and former government officials, military personnel, political figures, and journalists. The adversaries, dubbed “Handala” by some sources, leverage the same techniques across multiple CMA platforms, showcasing a strategic and adaptable approach. The phishing messages most commonly mimic official support channels, requesting actions that secretly grant access to the compromised account. Victims are typically lured into providing verification codes or scanning QR codes – the latter immediately linking their Signal and WhatsApp accounts to attacker-controlled devices. Once access is gained, attackers can silently monitor communications, participate in group chats, and transmit messages as the compromised user, significantly increasing the difficulty of detection and enabling a cascade of further phishing operations. Critically, the FBI emphasizes that the encryption mechanisms within Signal, WhatsApp, and similar platforms remain intact and were not breached. This campaign’s success hinges on exploiting user trust and susceptible behavior, not technical vulnerabilities within the communications apps themselves. The FBI’s attribution represents a shift from attributing cybercrime to broader “state hackers” to pinpointing specific intelligence-linked groups, notably the Handala actors. Earlier advisories from Dutch and French cybersecurity bodies corroborate this narrative, detailing similar account-hijacking operations reliant on the same trickery. The coordinated nature of these alerts across multiple European nations underscores the scope and sophistication of the threat. Lawrence Abrams, Editor in Chief of BleepingComputer.com, highlights the importance of heightened vigilance among Signal and WhatsApp users, recommending heightened suspicion of unexpected messages, conscious avoidance of QR code scans, and strict refusal to share verification codes, even with accounts claiming to represent official support channels. The overall picture presented by the FBI and allied cybersecurity agencies indicates a persistent and evolving threat that demands increased user awareness and proactive security measures. |