On 20 March 2026, the FBI and CISA issued a joint public service announcement saying that actors linked to Russian intelligence had gained access to thousands of accounts on commercial messaging apps, mainly Signal. The encryption was not broken. The attackers persuaded people to hand over verification codes and PINs, or to link the attacker's device to their account. For engineering teams, this is about how much an organisation relies on chat apps for sensitive work, and about the design of device-linking flows in general.
What happened
Alert I-032026-PSA describes a global campaign aimed at people of high intelligence value: current and former US government officials, military personnel, political figures and journalists. The FBI describes two main techniques:
- Fake support: messages pretending to be from an automated "Signal Security" bot or support account, asking the victim to send a verification code, PIN or 2FA code. With those, the attacker can register the account on their own device.
- Linked-device abuse: pretending to be one of the victim's contacts and sending a link or QR code that actually links the attacker's device to the victim's account. After that, the attacker silently receives a copy of the victim's messages.
With access, the actors read messages and contact lists, send messages as the victim, and use the trusted account to phish more people. The FBI says the attackers compromised individual accounts, not the apps or their encryption. Dutch intelligence services issued a similar warning on 9 March, and France's C4 crisis coordination centre published an alert on 20 March describing the activity as widespread and ongoing. On 26 June 2026 the FBI and CISA added a follow-up (I-062626-PSA): the actors had started tricking victims into creating a message backup and sharing the Backup Recovery Key, which exposes historical messages too.
Who is affected
- Officials, military personnel, journalists and political staff, plus anyone who talks to them on Signal or WhatsApp.
- Companies that use Signal or WhatsApp groups for incident response, executive communications or on-call coordination, where one hijacked member exposes the whole group.
- Product teams running any app with QR-based device linking or SMS/PIN-based account recovery.
What it means for developers and engineering teams
End-to-end encryption protects messages in transit between enrolled devices. It doesn't help when the attacker is an enrolled device. Signal's linked-devices feature works as designed: scan a QR code, and a new client receives future messages. The attack relies on that legitimate feature, social engineering and the fact that users rarely check which devices are linked.
If you build products with similar flows, take three design lessons from this. Make device linking hard to do by accident: show clear, plain-language confirmation of what is being granted, and add friction when a link request arrives from a message rather than from the app's own settings screen. Notify every existing device when a new one is linked. And treat recovery secrets (PINs, backup keys) as credentials that support staff never ask for. Then say so loudly in the UI.
For incident response, think about what happens if an attacker is sitting in your incident chat. Sensitive coordination channels need membership reviews, and you need an out-of-band way to verify who is who.
What to do now
- Check linked devices in Signal (Settings > Linked devices) and WhatsApp (Settings > Linked devices), and remove anything you don't recognise.
- Turn on Registration Lock in Signal and two-step verification in WhatsApp, so re-registering a number needs your PIN.
- Never share codes, PINs or backup recovery keys. Real support doesn't ask for them in the app. If you shared a recovery key, generate a new one in Settings right away.
- Verify unexpected requests out of band, especially QR codes or "join this group" links from contacts.
- Review membership of sensitive groups regularly for duplicate or lookalike accounts, and turn on disappearing messages where record-keeping rules allow.
- Report incidents to your security team and to ic3.gov.
Related on TechLogHub
Sources
- FBI/CISA PSA I-032026-PSA (20 Mar 2026)
- FBI/CISA PSA I-062626-PSA: Russian intelligence services continue to target messaging apps (26 Jun 2026)
- BleepingComputer: FBI links Signal phishing attacks to Russian intelligence services
- NL Times: Dutch intelligence confirms Russian state hackers targeting Signal and WhatsApp accounts (9 Mar 2026)