encrypted messaging

Russia-backed hacking groups have advanced their techniques to infiltrate encrypted messaging platforms like Signal, WhatsApp, and Telegram, posing a threat to journalists, politicians, and activists. These hackers are targeting Signal's "linked devices" feature using malicious QR codes to gain real-time access to victims' messages. Incidents have included compromised Signal accounts leading to military strikes. The Sandworm group has been linked to compromising Signal accounts on devices captured in Ukraine, utilizing a Russian-language website to provide instructions for linking accounts to their infrastructure. Successful breaches often go undetected for long periods, with attackers using modified Signal group invite pages and phishing kits. Additionally, threat actors have stolen Signal database files from Android and Windows devices, with malware like Infamous Chisel extracting sensitive data. Attacks on Signal and other messaging services are increasing, with Russia-aligned groups employing social engineering tactics against users of WhatsApp. In response, Signal has enhanced security measures, including a new interface to alert users of unauthorized device links and additional authentication steps.