Russia-linked actors target WhatsApp and Signal in phishing campaign

Russia-linked actors, allegedly tied to Russian Intelligence Services, are conducting phishing campaigns aimed at hijacking high-value accounts on WhatsApp and Signal, according to the FBI. The attacks target individuals of high intelligence value, including current and former U.S. government officials, military personnel, politicians and journalists, with thousands of accounts already compromised worldwide.

Operators impersonate messaging app support and push users to click links or share verification codes or PINs, enabling account takeover or linking a malicious device. The joint PSA from CISA and the Federal Bureau of Investigation notes that attackers may also deploy malware as the campaign evolves. Dutch intelligence agencies (MIVD and AIVD) have previously warned of a global campaign by Russia-linked threat actors targeting Signal and WhatsApp accounts of officials and military personnel.