FBI and CISA Warn Russian Intelligence Is Hijacking Signal and WhatsApp Accounts in Global Phishing Campaign
A joint FBI-CISA advisory says Russian-linked actors have compromised thousands of Signal and WhatsApp accounts belonging to government officials, military personnel, and journalists across multiple countries.
Overview
The FBI and CISA issued a joint public service announcement on March 20 warning that threat actors affiliated with Russian intelligence services are conducting a large-scale phishing campaign targeting users of Signal, WhatsApp, and other encrypted messaging platforms. The campaign has resulted in the unauthorized compromise of thousands of accounts worldwide, according to the advisory tracked as PSA 2026/032-0320.
The operation does not exploit any vulnerability in the platforms’ encryption. Instead, it relies on social engineering to trick high-value targets into surrendering account access, effectively walking around end-to-end encryption rather than breaking it.
What We Know
The primary targets include current and former U.S. government officials, military personnel, political figures, and journalists, according to the FBI-CISA advisory. The campaign has achieved global reach, with intelligence agencies in multiple countries issuing parallel warnings.
The attackers employ two distinct techniques. In the first, they impersonate platform support staff — using names such as “Signal Support” — and attempt to persuade victims to scan a malicious QR code or approve a device-linking request. Signal’s linked devices feature allows multiple devices to access the same account simultaneously. When a victim scans the attacker’s QR code, the attacker’s hardware is silently tethered to the compromised account, allowing them to read all messages as they are sent and received, as reported by NBC News.
The second technique involves extracting one-time verification codes or PINs from targets, often framed as a mandatory security step. If a victim shares these credentials, the attacker can register the account on their own device, locking the original user out entirely, according to Euronews.
Once an account is compromised, attackers can view messages and contact lists, send messages as the victim, and launch secondary phishing attacks from a trusted identity — making the campaign self-propagating.
A Cascade of International Warnings
The FBI-CISA advisory followed a series of European alerts. The Dutch intelligence agencies AIVD and MIVD issued a warning on March 9 describing a “large-scale global attempt” by Russian intelligence to compromise Signal and WhatsApp accounts, as NBC News reported. Germany had issued a similar warning in February regarding phishing attempts against Signal users in military and political circles. France’s Cyber Crisis Coordination Center (C4) published its own alert on the same day as the American advisory, according to Euronews.
The Dutch agencies confirmed that accounts belonging to government employees had already been compromised, according to NBC News.
The CyberScoop report noted that Google’s Threat Intelligence Group had previously highlighted Russian targeting of Signal users in Ukraine, warning that such tactics would “grow in prevalence in the near-term and proliferate to additional threat actors and regions.”
What We Don’t Know
The FBI and CISA have not publicly attributed the campaign to a specific Russian intelligence service — whether GRU, SVR, or FSB — nor named particular threat actor groups such as APT28 or APT29. The exact number of compromised accounts remains unspecified beyond “thousands.” It is also unclear how long the campaign has been active, though the European warnings suggest it has been underway for at least several months.
Whether the attackers have used compromised accounts to access sensitive classified communications or have primarily focused on mapping social networks and contact chains has not been disclosed.
Defensive Recommendations
The FBI and CISA recommend that users treat unsolicited messages with suspicion, avoid scanning QR codes from unknown sources, and never share verification codes or PINs with anyone — including individuals claiming to represent platform support. Signal stated that its support team “will never initiate contact via in-app messages, SMS or social media” to request a verification code, as reported by Euronews.
Users should also regularly review their linked devices list within Signal and WhatsApp settings, removing any devices they do not recognize.