Signal Users Targeted Through Twilio Exposure and QR-Code Device Linking

Signal disclosed that attackers accessed limited user data after compromising Twilio through a phishing campaign against Twilio employees, exposing information tied to about 1,900 users. The intruders sought three phone numbers and re-registered one affected account, while Signal said message histories, contact lists, profile information, and other account data remained protected because the service does not store them. Signal notified impacted users and advised them to re-register their numbers and enable additional account protections.

More recently, Google Threat Intelligence Group and other researchers reported that Russian state-linked actors have targeted Signal users in Ukraine through social engineering rather than by breaking Signal encryption. The most prominent tactic abuses Signal's linked devices feature by luring victims into scanning malicious QR codes, silently attaching an attacker-controlled device that can then receive future messages. Reporting linked activity to Sandworm and UNC5792/UAC-0195, and warned that similar QR-code and messaging-app takeover techniques are also being used against WhatsApp and Telegram, indicating a broader shift toward user-manipulation attacks on encrypted platforms.