US offers $10 million for info on group behind Signal, WhatsApp hacks

The campaign has been active since at least March, when the FBI issued an advisory warning about phishing efforts by attackers associated with Russian intelligence services. These attackers impersonate automated support communications, prompting targets to click links or provide verification codes and account passcodes. Compliance with these requests can lead to the attacker's device being linked to the user's account or a complete account takeover, locking the user out.

Once an account is compromised, attackers can read new messages. Signal's safety features prevent access to previous conversations unless users are tricked into providing encryption passcodes for backups. The FBI's recent update indicated that the campaign has evolved, with messages now urging users to create backups and then share the long passcode used to encrypt these backups stored on Signal servers. This allows attackers access to past conversations.

The FBI identified two Russian government groups, UNC5792 and UNC4221, as being responsible for these attacks. The agency also noted that hackers from Iran and post-Soviet countries are involved. One example message provided by the FBI mimics a Signal security update, informing users of increased hacking attempts and the introduction of mandatory two-factor verification, while guiding them through a backup process that ultimately compromises their account.