SIGNALS OF TROUBLE: MULTIPLE RUSSIA-ALIGNED THREAT ACTORS ACTIVELY TARGETING SIGNAL MESSENGER

Summary from the TLDR InfoSec newsletter

Google's Threat Intelligence Group (GTIG) has discovered that Russian-aligned threat actors are targeting Signal Messenger through phishing campaigns exploiting the app's "linked devices" feature. These actors use malicious QR codes and altered group invites to trick victims into linking their Signal accounts to actor-controlled devices. Multiple threat actors, including UNC5792 and UNC4221, are actively involved in these operations, along with efforts to steal Signal database files from Android and Windows devices.