Google Reports Russian Hackers Targeting Signal Accounts of Ukrainian Troops

Google's Threat Intelligence Group has uncovered a sophisticated phishing scheme employed by Russian state-backed hackers to compromise Signal Messenger accounts, primarily targeting Ukrainian military personnel. The attackers exploit the app's linked devices feature by sending malicious QR codes masquerading as legitimate group invites, which, when scanned, link the victim's account to a device controlled by the hackers. This method allows the attackers to intercept messages in real-time without needing full access to the victim's device. Notably, two Russian hacking groups, identified as UNC5792 and UNC4221, are primarily responsible for these attacks, which have also been aimed at journalists and activists. Following these revelations, Signal has released an update to alert users if their account is being linked to a new device. Experts warn that such tactics could soon extend beyond Ukrainian targets to affect a broader range of users and other encrypted messaging platforms.