The FBI and CISA just dropped PSA I-032026-PSA warning of a global phishing campaign by Russian Intelligence Services (RIS)-linked actors targeting commercial messaging apps (primarily Signal, but tactics apply to Telegram/WhatsApp too).
Core details from the official advisory:
• High-value targets: Current/former U.S. officials, military, politicians, journalists.
• Method: Fake in-app “support” messages (e.g., “Signal Security ChatBot”) claiming suspicious activity → trick users into clicking malicious links/QR codes (links attacker’s device) or sharing PINs/2FA codes (full takeover).
• Result: Attackers read messages, view contacts, impersonate victims, and phish further — bypassing encryption by owning the account.
• Scope: Thousands of accounts hit worldwide.
Read the full PSA: https://www.ic3.gov/PSA/2026/PSA260320
Additional context beyond this specific PSA (from concurrent March 2026 reports by Google Threat Intelligence, Lookout, iVerify, and others):
• A separate iOS zero-click exploit kit called DarkSword (targeting iOS 18.4–18.7) is in active use by suspected Russian group UNC6353 (among others). It enables drive-by infections via compromised “watering hole” sites — no click/download needed — deploying spyware that steals messages, location, photos, crypto wallets, and more.
• While the PSA sticks to account-level phishing, broader Russian-linked ops (including DarkSword watering holes) sometimes exploit human “vices” — curiosity around suggestive content, leaked celebrity videos, scandals, or private/political documents — to lure victims to malicious sites or prompts. These aren’t detailed in the FBI/CISA advisory but align with historical state-sponsored tactics to socially engineer high-value users when direct app compromise fails.
Quick protection steps:
• Never share codes/PINs or click unsolicited links in messaging apps.
• Verify suspicious messages out-of-band (call/text the real contact).
• Update iOS now if on 18.4–18.7.
• Enable disappearing messages; regularly check linked devices/groups.
• Report to IC3 or your security team.
Phishing still wins because it targets people, not code.
#CyberSecurity #FBI #CISA #SignalApp #Phishing #DarkSword #ThreatIntel #RussiaCyber
Disclaimer: Written with AI. The information above is for educational purposes based on public security reports. I do not represent any government agency, corporation, or employer. These views are shared on my personal time and device premises and do not constitute professional or legal security advice.
Writing by Dr. Dannielle Blumenthal 