Russian actors send fake messaging support SMS to harvest Signal and WhatsApp credentials from Ukrainian officials

The campaign delivered SMS lures claiming to originate from Signal or WhatsApp support, directing targets to disclose confirmation codes or scan malicious QR codes. SSU documented repeated waves against both institutional and personal accounts without naming a specific group, while FBI linked parallel commercial messaging phishing to Russian intelligence actors seeking backup keys. Technical patterns match prior activity by Star Blizzard and UNC5792 clusters, which previously used credential-harvesting lures against similar Ukrainian targets. The shift to direct SMS support impersonation bypasses email filters and exploits wartime reliance on encrypted messengers for operational coordination. Procurement records and prior CERT-UA alerts show Russian services have iteratively refined access operations against the same target pool since 2022, moving from spear-phishing documents to low-friction messaging vectors. This reduces attribution signatures while increasing volume against dispersed personal devices. Next indicators will appear in updated session-log reviews by Ukrainian agencies and any new FBI flash alerts on recovery-key theft within 90 days.