Russian Hackers Target Signal Users, Thousands of American Accounts Compromised, FBI Warns

Russian intelligence-linked hackers are compromising thousands of private messaging accounts in a sophisticated global campaign targeting high-value individuals, according to a joint warning from the FBI and the Cybersecurity and Infrastructure Security Agency (CISA).

The operation has successfully breached “thousands of individual” commercial messaging app accounts, giving attackers access to private messages, contact lists, and the ability to impersonate victims by sending messages under their identity, officials said.

FBI Director Kash Patel warned that the campaign specifically targets individuals of “high intelligence value,” including U.S. officials, military personnel, and journalists. The compromised accounts create a serious security risk as attackers can leverage trusted identities to target others in the victims’ contact networks.

“This global campaign has resulted in unauthorized access to thousands of individual CMA accounts,” the agencies stated in their public service announcement. “After compromising an account, malicious actors can view the victims’ messages and contact lists, send messages, and conduct additional phishing against other CMA accounts.”

While the warning didn’t specify which messaging platforms are being targeted, images in the alert featured Signal, a popular encrypted messaging service widely used by security-conscious individuals and organizations. The agencies emphasized that the attacks don’t compromise the encryption protocols of Signal or other messaging apps themselves. Instead, hackers are using sophisticated phishing techniques to trick users into surrendering access.

“Phishing remains one of the most unsophisticated, yet effective means of cyber compromise, often rendering other protections irrelevant, including end-to-end encryption,” the agencies noted.

The typical attack pattern involves hackers impersonating app support staff or sending fake security alerts designed to create a sense of urgency. These messages prompt users to click malicious links or share verification codes that allow attackers to connect their own devices to victims’ accounts or take complete control.

Cybersecurity experts note that this technique, while not technically sophisticated, is highly effective because it exploits human psychology rather than technical vulnerabilities. By creating convincing scenarios that trigger immediate action, hackers bypass sophisticated security systems.

The campaign represents a significant escalation in Russian intelligence operations targeting Western communications. While nation-state hackers have long targeted email and other communication platforms, this campaign shows a strategic shift toward encrypted messaging apps that many users consider more secure than traditional communications channels.

The timing of the campaign coincides with increasing geopolitical tensions between Russia and Western nations. Intelligence officials have warned that Russian cyber operations often intensify during periods of international conflict or ahead of significant political events.

For users of messaging apps, the FBI and CISA recommend implementing additional security measures, including two-factor authentication when available, verifying the legitimacy of any security alerts through official channels, and being wary of unexpected messages—even from trusted contacts—that contain links or request personal information.

Individuals who suspect they may have been targeted are urged to report incidents to the FBI’s Internet Crime Complaint Center. The agencies did not specify which Russian intelligence service is behind the operation, referring only to “cyber actors associated with Russian Intelligence” in their joint statement.

Signal did not immediately respond to requests for comment about the attacks. The company has previously emphasized that its end-to-end encryption remains secure against direct interception, though this campaign demonstrates that social engineering can circumvent even the strongest technical protections by targeting the human element.