Following warnings by US and European authorities about phishing attacks targeting Signal users, the messaging app has introduced enhanced security measures to reduce the risk of account takeovers through social engineering.
- Phishing campaigns exploit Signal’s linked devices to monitor messages.
- Impersonation tactics include fake support and contact profiles.
- Signal deploys warnings, second prompts, and educational tips in-app.
Threat signal
In early 2026, multiple security agencies including the FBI and CISA raised alarms about targeted phishing attacks against Signal users, attributing these efforts to Russian intelligence-linked threat actors. These campaigns primarily focused on abusing the linked devices feature which allows additional devices to sync messages from the same account. By impersonating trusted entities, attackers bait victims into approving unauthorized device links or sharing onetime verification data.
This method grants attackers near real-time access to sensitive private communications, representing a significant privacy and security risk for users. Traditional account compromise attacks are enhanced by these social engineering techniques, exemplifying adversaries’ continuing evolution to blend technical exploitation with psychological manipulation.
Operator exposure
For users and security teams managing Signal communications, the exposure lies in the ease with which threat actors can bypass technical controls through social engineering. The ability to link a malicious device to a user’s Signal account can silently compromise message confidentiality and integrity without immediate detection. Operators relying on Signal for secure communications need heightened vigilance to unusual or unexpected device-linking requests.
Additionally, attackers’ use of fake profile names and impersonation increases the risk of mistrust and inadvertent data leakage. The lack of verified identities on Signal profiles necessitates operator awareness that trust assessments cannot be based solely on profile information but must incorporate contextual verification and resistance to manipulation attempts.
What teams should watch
Security teams should prioritize user education on spotting and properly handling message requests, emphasizing Signal’s updated in-app warnings that remind users not to share verification codes or PINs and to critically evaluate profile identities. Enforcing policies against accepting unverified device link requests can reduce successful phishing attempts.
Furthermore, collaboration with Signal’s ongoing development of enhanced phishing protections is essential. Teams should monitor for upcoming app updates introducing additional safeguards and adapt their security awareness programs accordingly. Given the targeting by sophisticated intelligence-linked adversaries, proactive measures encompassing both technical controls and operator training remain critical.