TLDR:

• Russian intelligence-linked hackers have compromised thousands of Signal accounts through targeted phishing campaigns globally.
  
• High-value targets include current and former U.S. government officials, military personnel, journalists, and political figures.
  
• Signal’s encryption remains unbroken — Russian hackers bypass it by stealing user credentials through social engineering.
  
• The FBI urges Americans to never share PINs or 2FA codes and to report suspicious activity to IC3.gov immediately.

The FBI has issued a stark warning about Russian hackers actively targeting Americans who use Signal and other commercial messaging apps.

Working alongside the Cybersecurity and Infrastructure Security Agency, the bureau confirmed that thousands of individual accounts have already been compromised.

The campaign focuses on high-value targets, including current and former U.S. government officials, military personnel, political figures, and journalists. Authorities stress that Signal’s encryption is not at fault — end users are the primary vulnerability.

FBI Confirms Russian Hackers Are Actively Compromising Signal Accounts Across the Globe

Russian hackers linked to the country’s intelligence services have been running a coordinated phishing campaign against Signal users.

The operation involves sending messages disguised as official CMA support communications to unsuspecting targets. Once a user interacts with the message, the attacker gains full access to their account.

FBI Director Kash Patel publicly confirmed the threat, warning Americans through an official statement on X.

After gaining access, Russian hackers can read private messages and browse full contact lists. They can also send messages while posing as the account owner. This creates a chain of trust-based attacks that are difficult for recipients to detect.

The phishing messages are carefully tailored to each target, making them appear legitimate and urgent. Victims are typically asked to click a link, provide a verification code, or submit an account PIN. Any of these actions immediately hands control of the account to the attacker.

Authorities noted that the campaign continues to evolve. Russian hackers may expand their methods to include malware designed to infect victim devices directly. This development moves the threat beyond social engineering into more technically advanced territory.

Signal’s end-to-end encryption remains fully operational and has not been breached. However, the FBI warned that phishing renders encryption irrelevant when attackers access accounts directly. No level of encryption can protect a user who unknowingly hands over their credentials.

What Americans Can Do Right Now to Protect Their Signal Accounts

The FBI and CISA released joint guidance to help Americans defend against the ongoing Russian hacker campaign.

The first step is straightforward: stop all interaction the moment a message feels suspicious. Users should never share PINs or two-factor authentication codes for actions they did not personally initiate.

Any unsolicited message requesting account information should be treated as a potential phishing attempt. Even messages appearing to come from known contacts warrant caution if they contain unusual requests.

When uncertain, users should contact the sender through a completely separate channel before responding.

Group chats also need to be monitored carefully for unauthorized participants. Users should scan participant lists regularly for duplicate or unfamiliar accounts.

Any anomaly should be verified through secure communication outside of the app before further messages are shared.

The FBI reminded Americans that legitimate Signal support never sends verification links through direct messages.

Real support teams communicate exclusively through official email channels and never request codes or PINs inside the app. Any message claiming otherwise is almost certainly a phishing attempt by Russian hackers.

Americans who suspect they have been targeted should report the activity to the Internet Crime Complaint Center at IC3.gov or contact their nearest FBI field office.

Organizational IT and security teams should also be notified immediately. Fast reporting strengthens the FBI’s ability to track the campaign and protect additional accounts from being compromised.