Russian Spies Hijack Signal Accounts Bypassing Encryption

FBI issued a public service announcement (PSA) attributing a widespread, ongoing phishing campaign against encrypted messaging platforms—primarily Signal—to Russian intelligence services. The campaign has resulted in the compromise of thousands of accounts worldwide, targeting individuals with access to sensitive information.

Attackers do not exploit encryption weaknesses; instead, they bypass end-to-end encryption through account hijacking techniques, primarily via social engineering to steal verification codes or trick users into linking attacker-controlled devices.

This Threatfeed provides deep threat insights of the attack vectors, attribution, impact, and recommended mitigations, synthesizing information from the FBI, the Dutch General Intelligence and Security Service (AIVD), and France’s Cyber Crisis Coordination Center (C4).

End-to-end encrypted (E2EE) messaging apps like Signal and WhatsApp are widely used by government officials, military personnel, journalists, and activists to protect communications. However, Russian intelligence-linked threat actors have adapted their tactics to circumvent these protections. Rather than attempting to break cryptographic protocols, they employ targeted phishing campaigns to compromise user accounts at the authentication and device management layers. This approach grants persistent, undetected access to live conversations, contact lists, and group chats, enabling further intelligence gathering and secondary phishing attacks.

Threat Actor Attribution

The FBI’s March 2026 PSA marks the first official U.S. attribution of these campaigns directly to Russian intelligence services (rather than a generic “state-sponsored” label). This conclusion aligns with earlier warnings from Dutch and French authorities:

Dutch AIVD and MIVD (March 2026): Described “state-backed attackers” using similar account-hijacking methods against Signal and WhatsApp, noting the sophistication and targeting of high-value individuals.
France’s C4 (March 2026): Confirmed that the same tactics are widespread, ongoing, and observed across multiple countries.

The coordinated attribution suggests a strategic Russian intelligence operation, likely conducted by units such as the SVR, FSB, or affiliated groups, focusing on signal intelligence (SIGINT) collection via commercial messaging platforms.

Technical Analysis of Attack Vectors

The attack does not rely on vulnerabilities in the apps’ encryption. Instead, it exploits the device-linking and authentication features inherent to these platforms. Two primary methods have been observed:

Phishing Messages Impersonating Support

Victims receive unsolicited messages (via SMS, email, or the messaging platform itself) that appear to be from the platform’s “support” or “security” team. These messages often create urgency—e.g., “Your account requires verification” or “A new device attempted to log in”—and instruct the user to perform an action that inadvertently gives the attacker access.

Verification Code Harvesting

In this scenario, the attacker initiates a legitimate “register on new device” process using the victim’s phone number. The victim receives an SMS or in-app verification code. The phishing message tricks the victim into providing that code to the attacker, who then uses it to complete the registration on their own device. Once done, the attacker gains full access to the account, including all current and future messages.

Signal-specific nuance: When registering on a new primary device (e.g., a new phone), the old device is automatically disconnected. Victims may notice a sudden “no longer registered” state.

QR Code Device Linking

This method is particularly insidious because it does not deregister the victim’s primary device, making detection difficult. The attacker generates a QR code (or sends a malicious “link device” URL) that, when scanned by the victim, links the attacker’s device as a secondary device (Signal desktop or iPad, for example).

Signal: Users can link up to five secondary devices via QR code scanning. Once linked, the secondary device synchronizes past conversations (if configured) and receives all future messages in real time without any notification to the primary user beyond the initial linking.
WhatsApp: Offers a “Linked Devices” feature with similar functionality.

The phishing message disguises this QR code as a legitimate security or verification step. Upon scanning, the victim unknowingly authorizes the attacker’s device to read and send messages from their account.

Post Compromise Activity

After gaining access, attackers can:

Silently monitor private and group conversations.
Exfiltrate contact lists and metadata.
Impersonate the victim to launch additional phishing campaigns against the victim’s contacts (exploiting trust).
Persist access even if the victim changes passwords or verification methods, as long as the linked device remains active.

Impact and Scope

Compromised Accounts: The FBI reports “thousands” of accounts compromised globally.
Target Profile: Individuals with high intelligence value, including current/former U.S. government officials, military personnel, political figures, and journalists.
Geographic Spread: Multiple countries, as noted by French and Dutch authorities, indicating a wide-ranging intelligence collection effort.

The use of encrypted messaging apps by sensitive individuals makes this campaign particularly damaging, as it subverts the security assumptions of those apps.

Detection and Indicators of Compromise (IOCs)

Because the attack does not involve malware, traditional endpoint IOCs are limited. Detection relies on user behaviour and account anomalies.

User-Level Indicators:

Receiving unsolicited “support” messages requesting verification codes or QR code scanning.
Unexpected prompts to re-enter a verification code when not actively registering a new device.
Notifications of a new linked device that the user did not initiate.
Sudden inability to access an account or messages marked as read without user interaction.

Technical Detection (for organizations monitoring accounts):

Signal provides an “Linked Devices” list in settings; unexpected entries are a clear IOC.
WhatsApp similarly lists “Linked Devices” under Settings.
Logs from identity management systems (if accounts are federated) may show unusual authentication events or registration attempts from unfamiliar IPs/geolocations.

Network-Level IOCs:

No specific malware or C2 domains are provided, but organizations may monitor for phishing infrastructure masquerading as legitimate support domains. The content of the phishing messages often includes generic urgency language and may reference fake security alerts.

Mitigation Strategies

For End Users

Never share verification codes with anyone, including persons claiming to be platform support. Legitimate support never asks for these codes.
Never scan QR codes received unexpectedly, even if they appear to be from a trusted contact or a “security” message.
Regularly review linked devices in Signal (Settings → Linked Devices) and WhatsApp (Settings → Linked Devices) and remove any unrecognized devices.
Enable registration lock (Signal: Settings → Account → Registration Lock) to require a PIN when re-registering the account, preventing SIM-swap or code-based takeovers.
Use a strong, unique PIN for the app’s registration lock feature.
Be skeptical of any unsolicited communication that creates urgency or requests action. Verify independently through official channels.

High-Risk Individuals

Implement phishing-resistant MFA for any associated identity management systems, though note that Signal/WhatsApp do not support enterprise MFA outside of registration lock.
Conduct security awareness training focused specifically on messaging-app phishing, device linking, and verification code scams.
Monitor for suspicious linked devices on managed accounts if feasible (e.g., by asking users to regularly report).
Consider using separate, vetted devices for sensitive communications and restrict secondary device linking to controlled hardware.
For highly sensitive operations, consider using more tightly controlled secure communication platforms that support device management and audit logging.

The Russian intelligence-linked phishing campaign targeting Signal and WhatsApp represents a significant shift in tradecraft—bypassing end-to-end encryption through social engineering of authentication and device-linking mechanisms. The campaign has already compromised thousands of high-value accounts, enabling persistent surveillance and secondary exploitation. The coordinated warnings from U.S.,

Dutch, and French authorities underscore the scale and severity of the threat. Mitigation relies almost entirely on user vigilance and the adoption of platform-specific security features like registration lock and regular device audits.

As encrypted messaging becomes increasingly central to sensitive communications, such account-hijacking techniques will likely become a staple of state-sponsored intelligence collection, demanding continuous user education and possible platform-level enhancements to make device linking more transparent and harder to abuse.