TL;DR
A cybersecurity researcher exposed a Russian hacking campaign targeting Signal users, including high-profile figures. The hackers used phishing tactics and automated tools to compromise accounts, with ongoing attacks confirmed. The investigation highlights the threat posed by state-backed cyber espionage.
A cybersecurity researcher has revealed a targeted hacking campaign by Russian government-backed hackers attempting to hijack Signal messaging accounts, affecting more than 13,500 users including politicians and journalists.
Donacha Ó Cearbhaill, a security researcher at Amnesty International’s Security Lab, discovered that the hackers used a tool called ApocalypseZ to automate their attack efforts, targeting large numbers of Signal users in bulk. The hackers impersonated Signal support, sent phishing messages, and attempted to trick users into revealing verification codes, which would allow them to gain control of accounts.
Ó Cearbhaill identified that the attack infrastructure was operated in Russian, with the codebase and interface language in Russian, and observed that the hackers were translating victim chats into Russian. He linked this campaign to broader efforts by Russian state-backed actors, as confirmed by multiple Western cybersecurity agencies, including CISA and UK cybersecurity officials, who have warned of similar campaigns.
Why It Matters
This development underscores the ongoing threat of state-sponsored cyber espionage targeting secure messaging platforms. The campaign’s scale, involving thousands of targets, including high-profile individuals, highlights the vulnerabilities in encrypted communication tools and the persistent efforts by nation-states to compromise political, journalistic, and diplomatic figures. It raises concerns about the security of personal and professional communications and the potential for espionage and misinformation.
As an affiliate, we earn on qualifying purchases.
Background
Earlier this year, security researchers and intelligence agencies identified Russian hackers attempting to infiltrate various communication platforms, including Signal. The campaign, which has been linked to Russian state-backed groups, uses automated tools to identify and target potential victims, especially those with high-profile or sensitive roles. Signal has issued warnings to its users about phishing attempts, and authorities have increased awareness of the threat landscape surrounding encrypted messaging apps.
“Having the attack land in my inbox, and the chance to turn the tables on the attackers and understand more about the campaign was too good to pass up.”
— Donncha Ó Cearbhaill
“I am convinced this was the same Russian government hacking group behind similar campaigns.”
— Ó Cearbhaill
“The campaign aligns with previous activity attributed to Russian government actors targeting encrypted communication platforms.”
— Cybersecurity agencies (CISA, UK NCSC)
McAfee Total Protection 2026 Antivirus Software, 10+ Devices | Auto-Renews
- Device Security: Protects multiple devices in real-time
- Scam Detector: Identifies risky texts, emails, and videos
- Secure VPN: Private, unlimited VPN for safe browsing
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What Remains Unclear
While the campaign’s infrastructure and methods have been identified, the full scope of targets remains unclear, and it is not confirmed whether the hackers have succeeded in gaining long-term access to any accounts. The extent of the campaign’s impact on high-profile individuals and government officials is still being assessed, and the hackers’ ultimate objectives are not fully known.
encrypted messaging app security
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What’s Next
Authorities and Signal are expected to enhance security measures and issue further warnings. Monitoring of ongoing attacks continues, and investigations are likely to identify additional victims and infrastructure. Signal users are advised to enable security features such as Registration Lock to protect their accounts.
two-factor authentication hardware
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
How are the hackers attempting to hijack Signal accounts?
The hackers use phishing messages impersonating Signal support, tricking users into revealing verification codes, and deploying automated tools to target large groups of users.
Who is believed to be behind these attacks?
Multiple cybersecurity agencies attribute the campaign to Russian government-backed hacking groups, based on technical indicators and language used in the infrastructure.
What can Signal users do to protect themselves?
Users are advised to enable the Registration Lock feature, which requires a PIN to register the account on new devices, and to remain vigilant against phishing attempts.
Are high-profile targets involved?
Yes, reports indicate that politicians, journalists, and other prominent figures have been targeted, though the full scope of affected individuals is still being investigated.
