Russian Social Engineering Campaign Hijacked Signal and Messaging Accounts

Ukraine’s Security Service (SBU) said, in coordination with the FBI, it uncovered a long-running Russian campaign that used social engineering to compromise messaging accounts belonging to government officials, military personnel, politicians, activists, journalists, and other high-value targets in Ukraine, Europe, and the United States. According to Ukrainian and U.S. authorities, the attackers impersonated messaging-platform support teams in text and in-app messages, often contacting victims in the morning, and tricked them into handing over credentials and other sensitive account data to gain access to military, political, economic, and personal communications.

The FBI and CISA separately warned that Russian intelligence-linked operators are specifically phishing Signal Backup Recovery Keys, allowing them to restore backups, read private and group message history, and take over accounts without breaking Signal’s encryption. The updated advisory said the broader operation has already compromised thousands of accounts worldwide and is tracked publicly as UNC5792 and UNC4221, with links to multiple Russian intelligence services, including FSB-associated personnel and Russian military services. U.S. and allied agencies in the Netherlands, Germany, and France urged users to distrust messages claiming to be from Signal support, never share verification codes, PINs, or Recovery Keys, and review linked devices for unauthorized access.