1/mehr

Start der Trojaner-Sommerfestspiele in Ösi-Land am Mittwoch im Nationalrat! Im Vorfeld wurde nach Kräften wieder mit falschen Analogien herumgeschmissen & die Überwachung mit Trojaner-Schadsoftware als bloße technische Fortschreibung der Überwachung von Telefonienetzen ins Internet-Zeitalter dargestellt.

Das ist, als würde man eine richterlich genehmigte Hausdurchsuchung durch Polizeibeamte samt Protokoll, Dokumentation und Rechtssschutzbeauftragten mit ...

https://www.parlament.gv.at/aktuelles/pk/jahr_2025/pk0652

The Google Threat Intelligence Group (GTIG) says it has observed increasing efforts from several Russia state-aligned threat actors to compromise Signal Messenger accounts used by individuals of interest to Russia's intelligence services.

"The most novel and widely used technique underpinning Russian-aligned attempts to compromise Signal accounts is the abuse of the app's legitimate "linked devices" feature that enables Signal to be used on multiple devices concurrently. Because linking an additional device typically requires scanning a quick-response (QR) code, threat actors have resorted to crafting malicious QR codes that, when scanned, will link a victim's account to an actor-controlled Signal instance. If successful, future messages will be delivered synchronously to both the victim and the threat actor in real-time, providing a persistent means to eavesdrop on the victim's secure conversations without the need for full-device compromise."

"In remote phishing operations observed to date, malicious QR codes have frequently been masked as legitimate Signal resources, such as group invites, security alerts, or as legitimate device pairing instructions from the Signal website."

"In more tailored remote phishing operations, malicious device-linking QR codes have been embedded in phishing pages crafted to appear as specialized applications used by the Ukrainian military."

"Beyond remote phishing and malware delivery operations, we have also seen malicious QR codes being used in close-access operations. APT44 (aka Sandworm or Seashell Blizzard, a threat actor attributed by multiple governments to the Main Centre for Special Technologies (GTsST) within Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU), known commonly as the GRU) has worked to enable forward-deployed Russian military forces to link Signal accounts on devices captured on the battlefield back to actor-controlled infrastructure for follow-on exploitation."

Google says Signal, in collaboration with GTIG, has released updates for Android and iOS to mitigate these attacks. Users should update their apps immediately.

https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger