Czech NÚKIB warns Russian actors are phishing Signal users through linked devices
The Czech National Cyber and Information Security Agency published an analysis on October 13 of Russian-linked campaigns (including APT44/Sandworm and Turla) that trick Signal users into linking an attacker device, usually through fake support messages and malicious QR codes. Signal's encryption is not broken; the attack exploits user error. Similar activity is confirmed in Ukraine, Germany, France and the Netherlands, and the FBI estimates thousands of accounts affected worldwide.