Signal linked-device hijacking by Russia-aligned operators

Russia-aligned operators are hijacking **Signal** accounts by abusing the app's **linked devices** feature, creating unauthorized access to private conversations and contacts. The activity has been visible since the start of the year and targets high-value individuals, including current and former senior government, military, and political officials, as well as civil society organizations in the United States, the Middle East, and Europe. The access path relies on social engineering and account-linking abuse rather than a single software flaw. Available evidence says similar mobile-messaging operations in the same period have also used spoofed apps, phishing pages, QR-code device linking, and zero-click exploits. The practical effect is account takeover that can expose messages, support impersonation, and give attackers a durable foothold for follow-on compromise. Available material does not quantify reach, confirm a specific victim set, or describe a public remediation action.