information security news

Russian Hackers Target WhatsApp and Signal: A Growing Threat to Secure Communication

Russia-linked actors are increasingly targeting users of encrypted messaging apps like WhatsApp and Signal in sophisticated phishing campaigns, according to recent warnings from the FBI and cybersecurity agencies. These attacks aren’t breaking the encryption; they’re bypassing it by compromising the users themselves.

The Phishing Tactics: How Hackers Gain Access

The core tactic involves phishing – tricking individuals into revealing sensitive information. Attackers pose as legitimate support accounts for WhatsApp or Signal, sending tailored messages designed to steal verification codes or PINs. Once obtained, these credentials allow attackers to hijack accounts, gaining access to messages, contacts, and the ability to impersonate victims. The FBI warns that these campaigns specifically target individuals deemed “of high intelligence value,” including current and former government officials, military personnel, political figures, and journalists.

Exploiting Linked Devices

A particularly concerning technique involves exploiting the “linked devices” feature in Signal. Hackers trick users into adding the attacker’s device as a linked device, granting them access to the account. As the campaign evolves, the threat of malware deployment is also increasing, potentially leading to further compromise.

Why Target Encrypted Messaging Apps?

The focus on Signal and WhatsApp is noteworthy. Dutch intelligence agencies (MIVD and AIVD) have highlighted that Russia specifically targets Signal due to its strong end-to-end encryption. The goal isn’t to crack the encryption itself, but to circumvent it by gaining access to the accounts of individuals communicating sensitive information. Officials stress that these apps should not be used for classified or confidential information.

The Global Impact and Scale of the Attacks

These attacks are not limited to a single region. The FBI reports that thousands of accounts worldwide have already been compromised. The campaigns are global in scope, impacting individuals across various sectors and countries. The attacks are particularly concerning as they don’t exploit vulnerabilities within the apps themselves, but rather abuse legitimate features to target individual users.

Protecting Yourself: Staying Vigilant Against Phishing

Protecting yourself requires a heightened sense of vigilance. Here are key steps to take:

Be Suspicious of Unexpected Messages: Treat any unsolicited message, even from known contacts, with caution.
Never Share Verification Codes or PINs: Legitimate support teams will never ask for these.
Verify Links Before Clicking: Hover over links to check the destination URL before clicking.
Check Group Members: Be aware of who is in your group chats.
Utilize Security Features: Enable two-factor authentication (2FA) wherever possible.
Report Suspicious Activity: Immediately report any suspicious activity to the app’s security team or relevant authorities.

Pro Tip: Pause and think before acting on any message that asks for personal information or prompts you to click a link. A moment of hesitation can prevent a significant security breach.

Future Trends: What to Expect

The trend of targeting encrypted messaging apps is likely to continue and evolve. Here’s what experts anticipate:

Increased Sophistication of Phishing Attacks: Attackers will refine their phishing techniques, making them more convincing and harder to detect.
Expansion to Other Platforms: While Signal and WhatsApp are current targets, attackers may expand their focus to other encrypted messaging apps.
Greater Utilize of Malware: The deployment of malware alongside phishing attacks is expected to increase, providing attackers with more control over compromised devices.
AI-Powered Phishing: Artificial intelligence could be used to personalize phishing messages at scale, making them even more effective.

FAQ

Q: Can these attacks compromise the encryption of WhatsApp and Signal?
A: No, the attacks don’t break the encryption. They bypass it by gaining access to user accounts through phishing.

Q: What is the “linked devices” feature and why is it a risk?
A: The “linked devices” feature allows you to use Signal on multiple devices simultaneously. Attackers can exploit this by tricking you into adding their device, granting them access to your account.

Q: Will app developers fix these vulnerabilities?
A: The issue isn’t a vulnerability in the apps themselves, but rather a social engineering attack targeting users. App developers continue to enhance security features, but user vigilance is crucial.

Did you know? Legitimate app support will *never* ask for your verification code or PIN.

Stay informed about the latest cybersecurity threats and take proactive steps to protect your accounts. Explore additional resources on the FBI’s Internet Crime Complaint Center (IC3) and the Cybersecurity and Infrastructure Security Agency (CISA) websites.

Android Malware Enlists AI: A New Era of Mobile Threats

A newly discovered Android malware strain, dubbed “PromptSpy” by security firm Eset, is leveraging Google’s Gemini generative AI model to enhance its persistence mechanisms. This marks the second known instance of AI-driven mobile malware, signaling a concerning trend in the cybersecurity landscape.

How PromptSpy Works: AI-Powered Persistence

Unlike traditional malware that relies on static code and pre-defined instructions, PromptSpy dynamically adapts to its environment. It captures an XML dump of the user’s screen, including text labels and coordinates, and sends this data to Gemini. The AI model then provides JSON-formatted instructions on which interface elements to tap or manipulate. PromptSpy executes these actions locally, repeating the process until it achieves persistence on the device.

This innovative approach allows the malware to overcome the limitations of conventional automation scripts, which often fail due to variations in device layouts and manufacturer customizations. The malware’s ability to remain on a device even after a reboot is particularly noteworthy, as reboots have historically been considered a basic remediation step.

Accessibility Permissions and Removal Prevention

After installation, PromptSpy attempts to obtain AccessibilityService permissions – a common tactic among Android Trojans. Once granted, the malware employs removal prevention techniques, overlaying invisible interface elements over buttons like “stop,” “finish,” “clear,” or “Uninstall” to intercept user interaction and block removal attempts. The only reliable method for removing PromptSpy is to reboot the device into safe mode.

Capabilities Beyond Persistence

PromptSpy’s capabilities extend beyond simply maintaining its foothold on a device. It can also collect device information, upload lists of installed applications, capture lock screen PINs, record unlock patterns as video, report foreground app status, and capture screenshots.

Targeting and Origins

Researchers have traced PromptSpy samples to a website impersonating JPMorgan Chase under the name MorganArg, suggesting a focus on users in Argentina. Chinese-language strings within the malware’s codebase indicate potential development ties to a Chinese-speaking environment, though the activity has not been attributed to a known threat group.

The Rise of AI-Powered Malware: Following PromptLock

PromptSpy follows Eset’s August 2025 discovery of “PromptLock,” the first known GenAI-driven ransomware. PromptLock embedded a locally hosted large language model to dynamically generate encryption routines and malicious code at runtime. These two cases demonstrate a growing trend of threat actors experimenting with AI models to enhance the adaptability and effectiveness of their malware.

Future Trends: What’s Next for AI and Malware?

The emergence of PromptSpy and PromptLock signals a significant shift in the mobile threat landscape. We can expect to notice further development in several key areas:

More Sophisticated Evasion Techniques

AI will likely be used to develop malware that can dynamically evade detection by security tools. By analyzing system behavior and adapting its code in real-time, malware could become significantly harder to identify, and neutralize.

Automated Vulnerability Exploitation

AI could automate the process of identifying and exploiting vulnerabilities in mobile devices and applications. This could lead to a surge in zero-day attacks and a decrease in the time window for security teams to respond.

Personalized Phishing and Social Engineering

Generative AI can create highly personalized phishing messages and social engineering attacks, making them more convincing and difficult to detect. This could lead to a higher success rate for attackers and increased financial losses for victims.

AI-Driven Polymorphism

Malware could apply AI to constantly change its code, creating new variants that bypass signature-based detection systems. This polymorphism would make it challenging for security tools to preserve up with the evolving threat landscape.

FAQ

What is PromptSpy? PromptSpy is an Android malware that uses Google’s Gemini AI to automate its persistence on infected devices.

How does PromptSpy achieve persistence? It uses Gemini to analyze the screen and determine which interface elements to tap, allowing it to remain in the recent app list even after a reboot.

Is PromptSpy widespread? While the technical design is concerning, widespread deployment has not yet been confirmed.

What can I do to protect myself? Rebooting your device into safe mode is the most reliable way to remove PromptSpy. Be cautious when granting AccessibilityService permissions.

What is the significance of PromptSpy? It represents a new era of AI-powered malware, demonstrating how threat actors are leveraging AI to overcome traditional security measures.

Did you know? PromptSpy is the first known Android malware to use generative AI in its execution flow.

Pro Tip: Regularly review the permissions granted to apps on your Android device and revoke any that seem unnecessary or suspicious.

Stay informed about the latest mobile security threats and best practices. Explore more articles on endpoint security and cybercrime to protect yourself and your devices.