The National Cyber and Information Security Agency (NÚKIB) is warning about targeted phishing campaigns aimed at users of the Signal messaging app. These activities are primarily linked to actors connected to the Russian Federation, and their goal is to gain access to victims’ communications by exploiting human error. Given the popularity of the Signal app among high-profile individuals and the occurrence of cyber incidents associated with it in the Czech Republic, NÚKIB is publishing an analysis along with recommendations for the secure use of the app.
Attackers Are Not Targeting Encryption, but Users
Attackers are not attempting to break the Signal app’s end-to-end encryption. Instead, they use social engineering and phishing techniques to trick users into linking an attacker-controlled device to their account or disclosing their PIN or other credentials. The most common scenarios include fake messages posing as technical support, spoofed links, and malicious QR codes.
Campaigns recorded so far have primarily targeted individuals working in security, government, and politics. According to available information, similar techniques have been observed, for example, in Ukraine, Germany, France, and the Netherlands. However, the geographic scope of these activities is likely broader.
The Most Common Scenario: A Message Posing as a Signal Notification
The primary threat variant relevant to Czech users is so-called linked-device phishing. Knowing the victim’s phone number and assuming that they use Signal, attackers can send them a malicious message. This message most often appears to be a legitimate notification from Signal.
A second observed variant involves the use of a malicious QR code that may appear to be an invitation to join a group. Both variants may also trick users into entering their Signal PIN or other login or recovery credentials under a false pretext.
What NÚKIB recommends:
- Regularly check the list of connected devices and immediately remove any unknown ones.
- Enable the ‘Registration Lock’ feature.
- Never disclose your PIN or authentication credentials to anyone. Signal’s official support will never ask you for them.
- Do not scan QR codes or open links that you did not request.
- For more sensitive communications, use disappearing messages and restrict who can find you on Signal using your phone number.
- In case of suspicious communication, verify through a different communication channel that the message really came from the purported sender.
- Download Signal exclusively from the official Signal website at signal.org.
Related document: Misuse of the Signal app for phishing: https://nukib.gov.cz/download/publications_en/Misuse-of-the-Signal-app-for-phishing_ENG.pdf