Russian intel targets messaging apps in phishing campaigns
CISA and FBI warn that Russian Intelligence Services are actively targeting commercial messaging applications through ongoing phishing campaigns, updating 2026 guidance with new tactics.
The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have issued an updated Public Service Announcement warning of continued targeting of commercial messaging applications by Russian Intelligence Services (RIS) cyber threat actors. The activity involves ongoing phishing campaigns designed to compromise accounts on commercial messaging platforms.
This advisory updates previous guidance from March 2026, incorporating recent tactics observed in the wild along with recommended mitigations and samples of phishing messages used by RIS actors. The continued focus on commercial messaging applications suggests these platforms remain a priority intelligence collection vector for Russian state-sponsored actors.
Organizations using commercial messaging applications for business communications should review the updated guidance and implement recommended security controls. The persistent nature of these campaigns indicates a sustained operational priority by Russian intelligence services to gain access to communications on these platforms.
Mentioned in this report
Detection guidance
OAuth Device Code Authentication Flow Sign-In
Detects sign-ins using the OAuth device code authentication flow, a technique abused in RIS phishing campaigns that trick users into authorizing an attacker-controlled session or linked device. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: OAuth Device Code Authentication Flow Sign-In
id: 88723322-c31d-5f21-9225-d154a30ce791
status: experimental
description: 'Detects successful authentications that use the OAuth device code flow.
Russian Intelligence Services (RIS) actors have used device-code and device-linking
phishing lures to trick users into authorizing attacker sessions on commercial messaging
and cloud platforms, granting persistent access without needing the victim''s password.
'
references:
- CISA/FBI PSA on RIS targeting of commercial messaging applications
logsource:
category: authentication
product: azure
service: signinlogs
detection:
selection:
AuthenticationProtocol: deviceCode
filter:
ClientAppUsed|contains:
- Microsoft Authentication Broker
- Company Portal
condition: selection and not filter
falsepositives:
- Legitimate use of device code flow for headless/IoT devices or CLI tools (e.g.,
Azure CLI, PowerShell login on servers without browser)
- Enterprise-managed device onboarding via device code flow
level: medium
tags:
- attack.t1078
- attack.initial_access
author: Vorant
New Device or Session Linked to Messaging/Cloud Account Shortly After Authentication
Detects a new device or trusted session being registered to a user account, consistent with RIS phishing lures (e.g. malicious QR codes or device-linking links) that add an attacker device to a compromised messaging account for persistent read access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: New Device or Session Linked to Account After Authentication
id: 821cb855-c7c3-53dd-a2ae-9c8fbaa20408
status: experimental
description: 'Detects audit events where a new device is registered or linked to a
user''s account. RIS actors have used phishing messages containing malicious QR
codes or ''linked device'' invitations for commercial messaging apps to add an attacker-controlled
device to a victim''s account, enabling persistent access to communications without
further credential use.
'
references:
- CISA/FBI PSA on RIS targeting of commercial messaging applications
logsource:
category: application
product: azure
service: audit
detection:
selection:
OperationName|contains:
- Register device
- Add registered owner to device
- Approve device
condition: selection
falsepositives:
- Legitimate employee registering a new personal or corporate device through normal
enrollment workflows
- IT helpdesk-assisted device onboarding
level: medium
tags:
- attack.t1078
- attack.persistence
author: Vorant
Phishing Link Click Leading to Messaging App Authorization Page
Detects outbound web requests to external URLs containing device-linking or authorization-flow paths for commercial messaging platforms, consistent with spearphishing links used by RIS actors to hijack messaging accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound Request to Messaging App Device-Link Authorization Path
id: 79383b4b-ab3f-5a36-8c35-3e592f8b0b25
status: experimental
description: 'Detects HTTP/HTTPS requests from endpoints to URL paths associated with
device-linking or QR-code authorization flows on commercial messaging platforms,
which RIS phishing campaigns abuse to bind an attacker device to a victim''s messaging
account. This rule targets the generic behavioral pattern (device-link/pairing endpoint
paths) rather than any specific campaign domain.
'
logsource:
category: proxy
product: windows
detection:
selection:
c-uri|contains:
- /linkdevice
- /device-link
- /pair?code=
- /qr-link
condition: selection
falsepositives:
- Legitimate user-initiated device pairing/linking on a personal messaging account
- Security awareness testing or QA of messaging app pairing flows
level: low
tags:
- attack.t1566.002
- attack.initial_access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/resources-tools/resources/russian-intelligence-services-continue-target-commercial-messaging-applications
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free