Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger

This report describes Russian-aligned threat actors (UNC5792 and APT44) abusing Signal's legitimate "linked devices" feature by delivering malicious QR codes and modified group-invite pages that link victims' accounts to actor-controlled devices. Observed in both remote phishing and close-access battlefield operations, this low-signature technique enables persistent, real-time eavesdropping on secure conversations and is difficult to detect through centralized defenses.