\ue802<\/i>February 19, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Mobile Security \/ Cyber Espionage <\/span><\/p>\n Multiple Russian-aligned threat actors have been observed targeting individuals of interest via the privacy-focused messaging app Signal in order to gain unauthorized access to their accounts. The primary method used by these actors involves the exploitation of Signal’s legitimate ‘linked devices’ feature.<\/p>\n "The most novel and widely used technique underpinning Russian-aligned attempts to compromise Signal accounts is the abuse of the app’s legitimate ‘linked devices’ feature that enables Signal to be used on multiple devices concurrently," the Google Threat Intelligence Group (GTIG) said<\/a> in a report. In these attacks, threat actors, including one tracked as UNC5792, utilize malicious QR codes. When scanned, these codes link a victim’s account to an actor-controlled Signal instance, allowing threat actors to synchronously receive future messages in real-time, effectively eavesdropping on the victim’s conversations.<\/p>\n Google mentioned that UAC-0195 partially overlaps with a hacking group known as UAC-0195<\/a>. These malicious QR codes disguise themselves as group invites, security alerts, or legitimate device pairing instructions from the Signal website, or are embedded in phishing pages purporting to be specialized applications used by the Ukrainian military.<\/p>\n Another threat actor, UNC4221 (also known as UAC-0185<\/a>), targets Signal accounts used by Ukrainian military personnel through a custom phishing kit designed to mimic aspects of the Kropyva application used for artillery guidance. A lightweight JavaScript payload named PINPOINT is also used to collect user information and geolocation data through phishing pages.<\/p>\n Other adversarial collectives targeting Signal include Sandworm (APT44), which uses a Windows Batch script named WAVESIGN; Turla, operating a lightweight PowerShell script; and UNC1151, utilizing the Robocopy utility to exfiltrate Signal messages from infected desktops.<\/p>\n Signal has released updates for Android and iOS with hardened features to secure users against such phishing efforts. Users are advised to update to the latest version to enable these features.<\/p>\n The disclosure from Google comes after the Microsoft Threat Intelligence team attributed<\/a> the Russian threat actor Star Blizzard to a spear-phishing campaign leveraging a similar device-linking feature to hijack WhatsApp accounts. Recently, Microsoft and Volexity revealed<\/a> that multiple Russian threat actors use device code phishing to log into victims’ accounts by targeting them via messaging apps like WhatsApp, Signal, and Microsoft Teams.<\/p>\n "The operational emphasis on Signal from multiple threat actors in recent months serves as an important warning for the growing threat to secure messaging applications that is certain to intensify in the near-term," Google said. This threat includes not only remote cyber operations like phishing and malware delivery but also close-access operations where a threat actor briefly accesses a target’s unlocked device.<\/p>\n The disclosure follows the discovery of a new SEO poisoning campaign using fake download pages impersonating popular applications like Signal, LINE, Gmail, and Google Translate to deliver backdoored executables aimed at Chinese-speaking users. These executables exhibit infostealer-like functionality associated with the MicroClip malware strain.<\/p>\n Found this article interesting? Follow us on Twitter \uf099<\/i><\/a> and LinkedIn<\/a> to read more exclusive content we post.<\/p>\n\n Article Information \ue802February 19, 2025\ue804Ravie LakshmananMobile Security \/ Cyber Espionage Introduction to the Threat Multiple Russian-aligned threat actors have been observed targeting individuals of interest via the privacy-focused messaging app…<\/p>\n","protected":false},"author":19,"featured_media":5965,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-6445","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/02\/signal-qr-code.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/6445","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=6445"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/6445\/revisions"}],"predecessor-version":[{"id":6446,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/6445\/revisions\/6446"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/5965"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=6445"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=6445"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=6445"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Introduction to the Threat<\/h2>\n
Method of Attack<\/h2>\n
Actors Involved<\/h2>\n
Techniques Used<\/h2>\n
Other Threat Actors<\/h2>\n
Protective Measures<\/h2>\n
Context and Wider Implications<\/h2>\n
Conclusion<\/h2>\n
Related Threats<\/h2>\n
Call to Action<\/h2>\n
Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"