- Google scientists warn of an ongoing phishing campaign
- It distributes QR codes that give attackers access to people’s signal accounts
- The goals are mostly military personnel, experts warn
Russian state-sponsored threat actors have increasingly been targeting Signal Messenger users with QR-Coded Phishing Rack, Malware and More, experts have warned
A report from Google’s threat information group (GIRL) notes signal’s use among military staff, politicians, journalists, activists and other high-risk groups has recently become widespread, triggering Russian state-sponsored threat actors’ increasing interest, especially since the beginning of the Russo Ukrainian war.
As a result, various threat players (especially APT44 and UNC5792) have tried to abuse the “Linked Devices” feature in the attack. Linked devices allow users to connect multiple devices, such as laptops, tablets and mobile devices, to the same account. To simplify the login process, users can scan a QR code from a device already logged in, rather than entering a password or registering a new service.
QR codes
That said, cyber criminals have started sending phishing -e emails with invitations to fake groups, various security alarms and the like, which also has a QR code. If the victim scans it, the attacker’s device will be logged into their account and access contacts, messages and more.
Since the phishing -e email does not have a malicious link or attachment that can be scanned via E -mail security solutions, these e emails often make it past filters and into people’s inbox.
In addition to phishing, Russian and Belarusian threat groups also use malware and specialized tools to exfiltrating signal messages directly from compromised Android and Windows devices.
These endeavors include scripts such as Wavesign, which periodically extract messages from Signal’s database and notorious chisel, a well -known Android Malware variant. Other actors, such as Turla and UNC1151, have also geared Powershell and command line tools to steal stored signal messages from compromised computers.
