A high-profile security researcher recently turned the tables on a sophisticated hacking operation after being targeted by a deceptive phishing attempt on the encrypted messaging platform Signal. Donncha Ó Cearbhaill, who leads the Security Lab at Amnesty International, received a fraudulent message from a fake ‘Signal Security Support ChatBot’ claiming that his account had experienced suspicious activity. The attackers attempted to lure him into entering a verification code, a common tactic designed to hijack user accounts by linking them to unauthorized devices.

Rather than falling for the ruse, Ó Cearbhaill utilized his expertise to investigate the infrastructure behind the attack. His findings revealed that he was part of a massive, coordinated campaign that has targeted over 13,500 individuals, including numerous journalists and security professionals. The researcher identified the automated system used by the hackers as ‘ApocalypseZ,’ noting that the software’s interface and codebase were written in Russian. These linguistic markers, combined with the scale of the operation, align with intelligence reports attributing such cyber-espionage efforts to Russian state-backed actors.

The investigation suggests that the hackers are leveraging a ‘snowball’ effect, where compromised accounts are used to harvest contact lists and identify new, high-value targets. As the campaign continues to evolve, security experts are urging the public to remain vigilant against unsolicited support messages. To mitigate the risk of account takeover, users are strongly encouraged to enable the ‘Registration Lock’ feature within the Signal app, which requires a user-defined PIN to register a phone number on a new device, adding a vital layer of defense against unauthorized access.

Key Takeaways

• A large-scale phishing campaign targeting Signal users has been linked to Russian state-backed operatives.
• The attackers use a 'snowball' method, utilizing contact lists from compromised accounts to expand their reach to over 13,500 targets.
• Users can protect their accounts by enabling the 'Registration Lock' feature, which prevents unauthorized device linking.

Editor’s Analysis & Impact

This incident highlights the increasing sophistication of state-sponsored cyber-espionage, which is moving beyond traditional malware to focus on social engineering and account hijacking. By impersonating trusted platforms like Signal, attackers exploit the inherent trust users place in secure communication tools. The ‘snowball’ tactic of harvesting contact lists demonstrates a strategic shift toward automated, scalable phishing that targets specific professional networks, such as journalists and human rights advocates. As these groups continue to rely on encrypted messaging for sensitive communications, the industry must prioritize user education and the adoption of multi-factor authentication features like Registration Lock. The future outlook suggests that as platforms harden their technical defenses, state actors will increasingly rely on these ‘human-in-the-loop’ social engineering tactics to bypass encryption, making individual user awareness the final and most critical line of defense.

Frequently Asked Questions

Q: What is the 'Registration Lock' feature in Signal?
A: Registration Lock is a security setting that requires a user-defined PIN to register a phone number on a new device, preventing hackers from linking your account to their own devices even if they obtain your verification code.

Q: How can I tell if a Signal support message is fake?
A: Signal does not send messages to users via the app to request verification codes or report suspicious activity. Any message claiming to be from 'Signal Support' that asks for codes or personal information is a phishing attempt.