Russian Phishing Campaign Targets Signal Users in NATO Countries

• •Russian actors exploit Signal's device linking feature to access accounts.
• •Phishing campaigns target users in five NATO countries, including the Czech Republic.
• •Signal's end-to-end encryption remains intact; the attack relies on user error.

The Czech Republic's NÚKIB has confirmed that Russian actors are conducting targeted phishing campaigns against Signal users, exploiting the app's device linking feature. This operation has affected users in five NATO nations: the Czech Republic, Ukraine, Germany, France, and the Netherlands. The attackers are not breaking Signal's end-to-end encryption; instead, they trick users into linking their accounts to malicious devices via phishing tactics, including fake notifications and malicious QR codes. Reports indicate that unauthorized access has reached thousands of Signal accounts globally, with significant compromises in Germany and the Netherlands. NÚKIB warns that the actual scope of the operation is likely broader than currently documented. Recommendations for users include regularly checking connected devices and enabling security features.