Federal officials are warning the public about a wave of phishing attacks aimed at popular messaging apps, where hackers are gaining access to private accounts without breaking the apps’ encryption.
The Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency say the campaigns are linked to Russian intelligence groups and have already compromised thousands of user accounts.
Authorities stress that the apps themselves remain secure. Instead, attackers are tricking users into giving up access to their own accounts.
The schemes have mainly targeted high-profile individuals, including government officials, military members, politicians, and journalists. However, officials warn that the same tactics can be used on anyone.
Once inside an account, hackers can read messages, access contact lists, and send new messages posing as the victim, often leading to further scams targeting others.
Investigators say one common tactic involves messages that appear to come from a trusted contact and include a link or QR code. If opened, the attacker can connect their own device to the victim’s account. Another method involves sending messages that request a verification code or PIN. If the victim shares that information, the attacker can take over the account and lock the user out.
Officials say many of these messages are designed to look like alerts from app support teams, often warning of suspicious activity and urging immediate action.
The attacks have frequently targeted accounts on Signal, though similar tactics can be used on other platforms.
Authorities advise users to be cautious with unexpected messages, even if they appear to come from someone they know, and to avoid clicking unfamiliar links or scanning unknown QR codes. They also emphasize never sharing verification codes or PINs and regularly checking account settings for connected devices.
Officials note that legitimate support services do not request login codes through direct messages. Anyone who believes their account has been compromised is encouraged to report it to the FBI’s Internet Crime Complaint Center and take steps to secure their account.
Subscribe to The Shrewsbury Post Updates
