Signal

Signal became the target of Russian cyber espionage activities, where attackers exploited a feature allowing users to join groups via a QR code scan. Hackers sent phishing messages mimicking legitimate group invites but embedded with malicious JavaScript, which when scanned, linked victims' devices to the attackers', compromising message privacy. While Signal reacted promptly with a security update, the incident highlighted vulnerabilities in encrypted communication platforms that are widely used, including by Ukrainian military personnel. This type of social engineering enables attackers to surreptitiously monitor real-time message flows, presenting a significant breach of confidentiality and security.

Source: https://www.wired.com/story/russia-signal-qr-code-phishing-attack/

TPRM report: https://scoringcyber.rankiteo.com/company/signal-peak-ventures

"id": "sig001022525",
"linkid": "signal-peak-ventures",
"type": "Breach",
"date": "2/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'Technology',
                        'name': 'Signal',
                        'type': 'Company'}],
 'attack_vector': 'Phishing',
 'data_breach': {'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Messages'},
 'description': 'Signal became the target of Russian cyber espionage '
                'activities, where attackers exploited a feature allowing '
                'users to join groups via a QR code scan. Hackers sent '
                'phishing messages mimicking legitimate group invites but '
                'embedded with malicious JavaScript, which when scanned, '
                "linked victims' devices to the attackers', compromising "
                'message privacy. While Signal reacted promptly with a '
                'security update, the incident highlighted vulnerabilities in '
                'encrypted communication platforms that are widely used, '
                'including by Ukrainian military personnel. This type of '
                'social engineering enables attackers to surreptitiously '
                'monitor real-time message flows, presenting a significant '
                'breach of confidentiality and security.',
 'impact': {'data_compromised': 'Message privacy',
            'systems_affected': 'Signal messaging platform'},
 'initial_access_broker': {'entry_point': 'QR code scan feature',
                           'high_value_targets': ['Ukrainian military '
                                                  'personnel']},
 'lessons_learned': 'Vulnerabilities in encrypted communication platforms can '
                    'be exploited through social engineering tactics.',
 'motivation': 'Surveillance',
 'post_incident_analysis': {'corrective_actions': 'Security update',
                            'root_causes': 'Exploitation of QR code scan '
                                           'feature'},
 'response': {'containment_measures': 'Security update'},
 'threat_actor': 'Russian cyber espionage groups',
 'title': 'Russian Cyber Espionage Targeting Signal',
 'type': 'Cyber Espionage',
 'vulnerability_exploited': 'QR code scan feature'}