Russian phishing campaigns exploit Signal's device-linking feature

Russian threat actors have been launching phishing campaigns that exploit the legitimate “Linked Devices” feature in the Signal messaging app to gain unauthorized access to accounts of interest. Over the past year, researchers observed phishing operations attributed to Russian state-aligned groups that used multiple methods to trick targets into linking their Signal account to a device controlled by the attacker. In a report today, Google Threat Intelligence Group (GTIG) says that abusing Signal’s device linking feature is the “most novel and widely used technique underpinning Russian-aligned attempts to compromise Signal accounts.” Threat actors leveraged the feature by creating malicious QR codes and deceiving potential victims into scanning them to allow Signal messages to synchronize with the attacker’s device. It is a simple trick that does not require a full compromise of the target’s device to monitor their secure conversations. GTIG researchers observed this method being adapted by the type of target. In a broader campaign, the attacker would disguise the malicious code as a legitimate app resource (e.g. Signal group invites) or as device pairing instructions from the legitimate Signal website. For targeted attacks, the threat actor would add the malicious QR codes to phishing pages designed to be of interest to the potential victim, such as “specialized applications used by the ultimate targets of the operation.” Additionally, GTIG noticed that the infamous Russian ...