Already a subscriber? Make sure to log into your account before viewing this content. You can access your account by hitting the “login” button on the top right corner. Still unable to see the content after signing in? Make sure your card on file is up-to-date.
The US government has issued a warning about a widespread phishing campaign by Russian intelligence-linked hackers targeting messaging apps like Signal and WhatsApp to compromise high-value individuals’ accounts.
Getting into it: The announcement came from the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA), which warned that the campaign is specifically targeting individuals of “high intelligence value,” including current and former US government officials, military personnel, political figures, journalists, and other influential figures who may have access to sensitive information. According to the agencies, the attackers are not breaking encryption but instead relying on highly effective phishing tactics such as impersonating legitimate services like messaging platform support teams or sending fabricated security alerts designed to create urgency, ultimately pressuring users into interacting with malicious links, scanning QR codes, or handing over sensitive login details like verification codes or PINs. The FBI and CISA stressed that once a victim complies, attackers can either fully seize control of the account or quietly connect a separate device to it, depending on how the victim is manipulated.
Once inside, hackers can read through private conversations, pull from stored contact networks, pose as the account owner to message others, and expand the attack by targeting additional people through those trusted connections.
In response to the warning, Signal said its platform has not been breached and that its end-to-end encryption remains secure, stressing that the attacks are not exploiting any technical vulnerabilities but instead rely on phishing and social engineering. The company warned that attackers are impersonating trusted entities to trick users into sharing verification codes or linking unauthorized devices, and stressed that Signal will never contact users to request a PIN or verification code through messages, SMS, or social media.
This all comes as some of the most powerful US officials rely on Signal to communicate, which created a lot of controversy last year after senior members of the Trump administration (including Vice President JD Vance and Defense Secretary Pete Hegseth) used the app to discuss sensitive military operations in a group chat that was accidentally shared with a journalist. The exposure of those messages sparked backlash because it showed that highly sensitive national security discussions were taking place on a commercial messaging platform outside official government systems, raising concerns about record-keeping, oversight, and operational security.
Critics argued that even though Signal offers strong end-to-end encryption, it is not designed for classified communications, and the incident demonstrated how easily information could be exposed through user mistakes rather than technical flaws.
