Russian Hackers Target WhatsApp and Signal Accounts of Officials, Military Personnel and Journalists

FBI and CISA warn that Russian intelligence-linked groups are running a phishing campaign against Signal, WhatsApp and Telegram users. Victims receive fake support messages requesting recovery keys, allowing attackers to hijack accounts and access sensitive conversations.

Russian Hackers Target WhatsApp and Signal Accounts of Officials, Military Personnel and Journalists

The Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency issued a joint alert on 26 June 2026, warning that Russian intelligence-linked groups are conducting a phishing operation aimed at users of encrypted messaging applications. The Romanian National Cyber Security Directorate also disseminated the advisory, as reported by România Liberă.

The malicious activity is attributed to clusters associated with Russia's Federal Security Service and military intelligence structures, publicly tracked as UNC5792 and UNC4221.

Targets include government officials, military personnel, journalists and individuals with access to classified or sensitive information.

The attackers send messages that appear to come from the application's customer support team. The texts cite fabricated security or synchronization problems and instruct recipients to enable backup functionality. Users are then urged to hand over their account recovery key, supposedly to verify or restore access.

Once the recovery key is obtained, the perpetrators can seize control of the account and read conversations and other private data.

Cybersecurity authorities emphasize that legitimate support teams for messaging apps never ask for verification codes, PINs or recovery keys inside chat conversations. All official communication takes place through verified channels such as email.

Users are advised never to share their recovery key with anyone, regardless of the explanation given. If a key has already been disclosed, it should be regenerated immediately through the Settings and Backup menu, because the old key remains valid indefinitely, even if the same phone number is used to create a new account.

Any suspicious message should be reported and the sender blocked. Before responding to security-related requests, users must verify the information exclusively through the application's official channels and avoid clicking links received in chat threads.

Source: Romania Libera