Russian hackers target Signal accounts in growing espionage effort
Google's Threat Intelligence Group (GTIG) has identified a rise in Russian state-backed hacking attempts aimed at compromising Signal messenger accounts.
These attacks primarily target individuals of interest to Russia's intelligence services, including military personnel, government officials, journalists, and activists.
While these efforts are currently tied to Russia's war in Ukraine, experts warn that similar tactics may soon be adopted by other threat actors worldwide. The broader concern extends beyond Signal, as Russian-aligned groups have also been observed targeting messaging platforms like WhatsApp and Telegram using comparable methods, according to the group's latest report published on Feb. 19.
Experts warn that these attacks signal a growing global trend in cyber espionage, where governments and hacking groups are increasingly seeking to infiltrate secure messaging apps.
The primary technique used in these attacks involves exploiting Signal's "linked devices" feature, which allows users to connect additional devices to their accounts. Hackers have crafted malicious QR codes that, when scanned, link a victim's Signal account to a hacker-controlled device.
Read also: US, UK, Australia sanction Russian cyber firm Zservers over ransomware attacks
This enables them to intercept messages in real-time without needing direct access to the victim's phone. Phishing campaigns distributing these malicious QR codes have been disguised as legitimate Signal security alerts, group invitations, or even official device-pairing instructions from the Signal website. In some cases, hackers have embedded these QR codes within fake applications designed to mimic software used by the Ukrainian military.
Beyond remote phishing, Russian cyber operatives have also deployed this tactic in battlefield scenarios.
The group APT44—also known as Sandworm, a unit linked to Russia's military intelligence agency (GRU)—has reportedly used the method on captured devices. Soldiers' Signal accounts are being linked to Russian-controlled infrastructure, allowing continued surveillance of sensitive conversations. This approach is difficult to detect because Signal does not have a centralized system for flagging new linked devices, meaning a successful breach could remain unnoticed for an extended period.
Signal, in collaboration with Google, has since strengthened its security measures to counter these phishing attempts. The latest updates for both Android and iOS include enhanced protections designed to prevent unauthorized device linking. Users are urged to update their apps to the newest version and remain cautious of suspicious QR codes or unexpected device-linking requests.
Read also: Ukrainian defense tech company Huless raises over $1 million for tethered drone systems
We've been working hard to bring you independent, locally-sourced news from Ukraine. Consider supporting the Kyiv Independent.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Yahoo
25 minutes ago
- Yahoo
Ukraine war latest: Kyiv attacks Crimean bridge for 3rd time since beginning of Russia's full-scale invasion
Key developments on June 3: Russia's Crimean Bridge rocked by explosions, Ukraine's SBU claims responsibility Russian strike on downtown Sumy kills at least 4, injures 28, authorities say Ukraine to deploy new units to counter Russian drone attacks, Air Force says Ukrainian strike on Russian bombers alarmed Kremlin over nuclear carriers vulnerability, Bloomberg reports Record number of Russians support peace talks, end of war in Ukraine, poll shows The Security Service of Ukraine (SBU) carried out the third attack against the Crimean Bridge since Russia's full-scale war began in 2022, mining and damaging its underwater supports, the SBU announced on June 3. "God loves the Trinity, and the SBU always brings what is conceived to the end and never repeats itself," SBU Chief Vasyl Malyuk said in a statement posted on social media. "Previously, we struck the Crimean Bridge in 2022 and 2023. So today we continued this tradition underwater," he added. The SBU said the operation "lasted for several months, with agents mining the "supports of this illegal construction." Constructed after Russia's illegal occupation of Crimea in 2014, the Crimean Bridge is a critical supply and transport route for Russian forces to the occupied Ukrainian territories. "And today, without inflicting any civilian casualties, the first explosive was activated at 4:44 a.m.," the SBU said. Join our community Support independent journalism in Ukraine. Join us in this fight. Support Us Underwater supports of the bridge's piers were severely damaged at the bottom as 1,100 kilograms of explosives in TNT equivalent were detonated, according to the statement. Russian state media later reported a "Ukrainian intelligence agent" who had constructed a bomb on "orders from Kyiv" had been detained by Russia's FSB. In comments later on June 3, Dmytro Pletenchuk, a spokesperson for the Ukrainian Navy, said the "key and most cpmplex" part of the bridge had been damaged in the attack. The operation, which follows the SBU's mass drone strike against Russia's strategic aviation on June 1, was personally supervised by the agency's chief, Vasyl Maliuk. A claimed "agent of Ukrainian intelligence services" has been detained in Crimea, Russia's Federal Security Service said later on June 3, accusing the detainee of producing a "powerful explosive." The bridge suffered significant damage during two previous Ukrainian attacks in October 2022 and July 2023, though neither managed to take the bridge out of commission. The construction of the bridge, also known as the Kerch Bridge, holds a significant symbolic value for Russia. The $4 billion project was a political statement designed to affirm the Kremlin's illegal 2014 annexation of Crimea, as the peninsula is not connected by land to Russia. Russia's Defense Ministry previously claimed that three Ukrainian drones were downed over Crimea overnight on June 3. The Crimean Bridge was closed for traffic between 6 and 9 a.m. local time on that day, according to local Telegram channels. The Mash Telegram channel reported that a Ukrainian drone was shot down over the bridge, and its debris fell onto the road. According to pro-Ukrainian Telegram channel Crimean Wind, the bridge had been closed down for inspection, possibly to examine damage. Later the same day, Crimean Wind reported a new "powerful explosion" near Kerch at around 3 p.m., writing that a helicopter is patrolling the strait. Several local channels reported that a fresh drone attack against the peninsula was underway in the afternoon, and that the bridge is closed once again. The Kyiv Independent could not verify the claims. Russian forces attacked downtown Sumy in Ukraine's northeast on June 3, killing four people and injuring 28 others, including three children, according to Ukrainian authorities. According to preliminary reports, Russia launched five attacks on Sumy using multiple launch rocket systems. "The Russians launched a savage strike on Sumy — directly targeting the city and its ordinary streets with rocket artillery. It was a fully deliberate attack on civilians," President Volodymyr Zelensky said on X. A 17-year-old was among the injured, with authorities describing the condition of many victims as serious. At nearly 4:30 p.m. local time, the death toll rose to four after a 43-year-old man who was in a serious condition died in the hospital. His seven-year-old daughter was also severely injured in the Russian attack. The attack reportedly set two cars ablaze, destroying them completely. A medical facility and residential buildings were also damaged. At 7 p.m. local time, rescuers finished working at the sites of the attacks. Sappers also examined the affected area and removed the remains of explosives, the State Emergency Service reported. Local authorities declared June 3 and 4 a day of mourning in Sumy. According to Zelensky, at least one of the projectiles used by Russia in the attack on Sumy failed to detonate, piercing the wall of a nine-story apartment building. "That alone says everything one needs to know about Russia's so-called 'desire' to end this war," he added, calling on the U.S. and Europe to increase pressure on Moscow. Sumy Oblast, which borders Russia to the north, has been a repeated target of Russian incursions and shelling since the start of the full-scale invasion in 2022. The region has recently seen renewed hostilities as Russian forces ramp up activity along the northeastern border. In late May, President Volodymyr Zelensky said that Russia is accumulating 50,000 troops near Sumy Oblast, seeking to create a 10-kilometer buffer zone in the area. Read also: As 50,000 Russian troops amass, Ukraine's Sumy Oblast braces for potential large-scale offensive New air defense units will be established to counter Russia's drone attacks on Ukraine, Air Force spokesperson Yurii Ihnat said in an interview with Ukrainska Pravda on June 2. Despite ongoing peace talks, Russia continues to reject calls for an unconditional ceasefire, intensifying drone and missile attacks on Ukrainian cities, killing and injuring civilians. Overnight on June 1, Russia launched an aerial assault on Ukraine, deploying a record 472 drones. Ukrainian forces downed 210 drones, including Shahed-type attack drones, while 172 more drones were intercepted by electronic warfare or disappeared from radars, according to the Air Force. "We would have liked to have had better results, but there were still dozens of hits," Ihant said. According to Ihant, Russia employed tactics involving the launch of a large number of weapons at a single target that approached from high altitude. During their meeting on June 2, air force commanders emphasized the urgent need to strengthen drone air defense capabilities, he said. "We are talking about anti-aircraft drones that help intercept air targets. Crews are being trained in different locations on the territory of our country. New units will be introduced," the spokesperson said. Russia seeks to produce up to 500 drones per day, President Volodymyr Zelensky said in late May. Meanwhile, Ukraine has more than doubled its long-range drone production in 2024 compared to the previous year — a staggering 22-fold increase since 2022. By the end of 2024, Ukraine had developed a total of 324 new types of weapons, according to the Ministry of Strategic Industries. Read also: Exclusive: Russia's ballistic missile production up at least 66% over past year, according to Ukrainian intel figures A recent Ukrainian drone strike deep inside Russian territory has sparked anger and concern among Kremlin officials over the exposed vulnerability of a nuclear-capable air force far from the front lines, Bloomberg reported on June 2, citing undisclosed sources close to senior Moscow officials. The Security Service of Ukraine (SBU) carried out the operation "Spiderweb" on June 1, targeting Russian air bases at Belaya, Diaghilev, Olenya, and Ivanovo with drones hidden in trucks across Russia. The strike is claimed to have hit 41 aircraft, including Tu-95 and Tu-22 bombers. These planes belong to Russia's nuclear-capable air fleet and are used to launch cruise missile attacks on Ukraine's cities. Ukraine's General Staff said in its daily update on June 3 that Russian forces lost 12 aircraft, without elaborating on the types of destroyed planes or whether more had been damaged. Meanwhile, a source close to the Kremlin told Bloomberg that the number of affected aircraft may be closer to 10. According to the outlet's sources, only a small number of the targeted Russian bombers are required for strikes against Ukraine, meaning the pace of missile and bombing attacks is unlikely to slow. The SBU claimed the operation caused approximately $7 billion in damage and disabled one-third of Russia's cruise missile bombers. Independent confirmation of the damage caused is so far limited to satellite images of Belaya air base, which appear to confirm the destruction of at least three Tu-95MS strategic bombers and one Tu-22M3 aircraft, with an additional Tu-95MS visibly damaged. Another image shows two more likely destroyed Tu-22M3 bombers on the field. The number of Russian citizens who support peace talks and an end to the war in Ukraine has reached a record high since the start of the full-scale invasion, according to a poll by the independent Russian pollster Levada Center published on June 2. Some 64% of the respondents favored peace talks, representing a 6% increase since March. Meanwhile, the number of people who supported the war's continuation decreased from 34% in March to 28% in May. Compared to previous survey results, in May 2023, 48% of respondents believed that the war should continue. In May 2024, this figure dropped to 43%. The news comes after the second round of direct peace talks between Ukraine and Russia occurred in Istanbul. The parties agreed on a new prisoner exchange, as well as the repatriation of 6,000 bodies of fallen Ukrainian soldiers. No agreement on a ceasefire was reached. The share of supporters of peaceful negotiations is higher among women (73%), people under 24 (77%), residents of villages and towns with populations under 100,000 (67% each), as well as those who believe that the country is going in the wrong direction (76%) and those who disapprove of Russian President Vladimir Putin's presidential performance (77%). The share of those who support continuing the war is higher among men (39%), respondents aged 55 and older (35%), residents of Moscow (40%), those who believe that things in the country are going in the right direction (32%), and those who approve of the activities of the current president (30%). A majority of respondents (73%) believe that Russia and Ukraine should address the hostilities' root causes and only then agree on a ceasefire. On the contrary, some 18% think that the parties will first reach a truce and ceasefire and then resolve all other issues. Only 3% of Russians believe Russia is an obstacle to peace. At the same time, 14% of respondents believe that the U.S. is to blame, while 36% each see Ukraine and European countries as major obstacles in peace negotiations. The center conducted the survey from May 22 to 28, involving 1,613 people aged 18 and older in 50 regions of Russia. Ukraine War Latest is put together by the Kyiv Independent news desk team, who keep you informed 24 hours a day, seven days a week. If you value our work and want to ensure we have the resources to continue, join the Kyiv Independent community. We've been working hard to bring you independent, locally-sourced news from Ukraine. Consider supporting the Kyiv Independent.
Yahoo
25 minutes ago
- Yahoo
Satellite images reveal damage to Russian Belaya airbase after Ukrainian drone strikes
Radio Liberty journalists have released satellite imagery showing the consequences of Ukrainian drone strikes on Belaya airbase in Russia's Irkutsk Oblast on 1 June 2025. Source: Radio Liberty Details: Analysis of video and satellite imagery enabled Radio Liberty to independently confirm the destruction of at least 11 Russian aircraft during the Ukrainian Security Service's Pavutyna (Spider's Web) operation on 1 June: seven Tu-95 bombers (one possibly damaged), four Tu-22M3 bombers and one An-12 cargo aircraft, not classified as strategic warplane. At Belaya airbase, Radio Liberty verified the destruction of four Tu-22M3 and three Tu-95 bombers, with one additional Tu-95 likely damaged. Background: On 1 June, the Security Service of Ukraine carried out a special operation codenamed Pavutyna, during which strategic aviation aircraft were targeted at four Russian airfields. SSU chief Vasyl Maliuk stated that "in total, 34% of strategic cruise missile carriers at the main Russian airfields were destroyed". The SSU officially stated that 41 Russian strategic aircraft, including A-50s, Tu-95s, Tu-22M3s and Tu-160s, had been struck by first-person view drones. The estimated cost of the damaged warplanes is over US$7 billion. Support Ukrainska Pravda on Patreon!
Yahoo
25 minutes ago
- Yahoo
'There was blood on the asphalt' — Russia strikes Ukraine's Sumy during morning rush hour
Editor's note: Cukr journalists contributed to the reporting of this article. The Ukrainian city of Sumy was once again the target of a devastating Russian missile strike on June 3, with four people killed and 28 others, including three children, injured. "The body of a man, killed in the attack, lay on the roadway. It was covered with a thermal blanket, weighed down by fire extinguishers and a bottle of water," Cukr journalist Artem Korol told the Kyiv Independent. "The air was thick with the smell of fuel, likely spilled from ruptured tanks. Remnants of the munition protruded from the asphalt, and dozens of small potholes in the road emerged around it," Korol added Russia launched the attack during rush hour. Anna Shpurik, also a journalist at Cukr, described how she saw the yellow number 55 bus stop at a red light moments before an explosion. Shell fragments peppered the vehicle but all the passengers survived, the driver escaping with just an injured arm. Four others were less fortunate, just the latest civilians killed in escalating Russian strikes on the oblast. Sumy lies in northeastern Ukraine just over 30 kilometers from the Russian border, and has suffered relentless attacks from Russia since the start of the full-scale invasion. "At about 9 a.m., the Russians launched an insidious attack on the city center. One of the shells hit a busy road, right during the morning rush hour. People were just going about their daily business," Oleh Hryhorov, head of Sumy Regional State Administration, said on Facebook. Russia launched five attacks on Sumy using multiple launch rocket systems, according to local authorities. The attack set two cars ablaze, destroying them completely. A medical facility and residential buildings, a private house, and non-residential buildings were also damaged. Sumy Oblast has recently seen renewed hostilities as Russian forces ramp up activity along the northeastern border. In late May, President Volodymyr Zelensky said that Russia is accumulating 50,000 troops near Sumy Oblast, seeking to create a 10-kilometer buffer zone in the area. But even with the escalating recent attacks and tensions, the timing and brutality of the attack still shocked those in Sumy. "No one ever expects this," Ihor Klymenko, head of the Prolisok humanitarian center in Sumy Oblast, told the Kyiv Independent. "It was a fully deliberate attack on civilians." "People are a little nervous and in a state of shock because it is the city center during a working day." When Klymenko arrived at the scene "the cars were still running, and there was blood on the asphalt". "Leaves had fallen from the explosions, all covered in glass and blood," he added. Later that morning, shops, kiosks, and a pharmacy were already open and operating along the street that was hit. After the blast shattered windows, employees swept up glass and talked on the phone with their relatives, assuring them they were safe, Shpurik said. The attack came amid ongoing talks of a ceasefire and peace negotiations. A day before, on June 2, Russia and Ukraine held a second round of talks in Istanbul, which focused on a new prisoner exchange, but yet again failed to achieve a breakthrough in peace efforts. "The Russians launched a savage strike on Sumy — directly targeting the city and its ordinary streets with rocket artillery. It was a fully deliberate attack on civilians," President Volodymyr Zelensky said on X. According to Zelensky, at least one of the projectiles used by Russia in the attack on Sumy failed to detonate, piercing the wall of a nine-story apartment building. "That alone says everything one needs to know about Russia's so-called 'desire' to end this war," he said. Read also: Russia's Crimean Bridge rocked by explosions, Ukraine's SBU claims responsibility We've been working hard to bring you independent, locally-sourced news from Ukraine. Consider supporting the Kyiv Independent.
