Google exposes new Russian phishing scheme concentrating on Ukrainian troops in Sign messaging app

The Google Menace Intelligence Group (GTIG) has uncovered a brand new Russian scheme to entry messages within the encrypted Sign app, a tactic used to extract info from Ukrainian troopers' communications.

Supply: Mezha Media, a expertise and IT information platform inside Ukrainska Pravda’s holding firm, citing the GTIG in an announcement

Particulars: The GTIG reported that a number of hacker teams with shut ties to the Russian authorities have been conducting phishing assaults. Recognized as UNC5792 and UNC4221, these teams exploited the messaging app's QR code function designed for becoming a member of new chats. They despatched phishing messages with QR code invites that contained hidden JavaScript instructions, enabling them to hyperlink the goal's smartphone to a brand new system and acquire entry to all messages.

These messages resembled common chat invites, showing to come back from army teams on Sign. Nonetheless, as soon as customers scanned the QR code, their system was immediately linked to the attackers' system, granting entry to their message historical past.

Google and Sign groups said that the scheme didn’t compromise the messenger’s encryption. As a substitute, it relied on two purposeful QR codes: one for inviting customers to a brand new group and one other for linking the account to the attackers' system by way of the Linked Units function. When scanned, the QR codes seamlessly swapped, making the change undetectable to the person.

Final week, Sign launched an replace for its iOS and Android apps to stop such assaults. Customers will now obtain a warning if their account is being paired with a brand new system and will likely be required to substantiate earlier than granting entry to their messages.

Google notes that comparable ways have been used in opposition to different messaging apps, resembling Telegram and WhatsApp. Nonetheless, Sign was the first goal because of its widespread use among the many Ukrainian army. The corporate additionally emphasised that this technique was not restricted to Ukrainians however was additionally deployed in opposition to activists, journalists and different Sign customers worldwide.

Assist Ukrainska Pravda on Patreon!