Russian intel targets messaging apps in phishing campaigns
CISA and FBI warn that Russian Intelligence Services are actively targeting commercial messaging applications through ongoing phishing campaigns, updating 2026 guidance with new tactics.
Sourcecisa.gov — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have issued an updated Public Service Announcement warning of continued targeting of commercial messaging applications by Russian Intelligence Services (RIS) cyber threat actors. The activity involves ongoing phishing campaigns designed to compromise accounts on commercial messaging platforms.
This advisory updates previous guidance from March 2026, incorporating recent tactics observed in the wild along with recommended mitigations and samples of phishing messages used by RIS actors. The continued focus on commercial messaging applications suggests these platforms remain a priority intelligence collection vector for Russian state-sponsored actors.
Organizations using commercial messaging applications for business communications should review the updated guidance and implement recommended security controls. The persistent nature of these campaigns indicates a sustained operational priority by Russian intelligence services to gain access to communications on these platforms.
Mentioned in this report
Detection guidance
Phishing Link Click Leading to Messaging App Authorization Page
A behavioural hunt for the technique in general.
Detects outbound web requests to external URLs containing device-linking or authorization-flow paths for commercial messaging platforms, consistent with spearphishing links used by RIS actors to hijack messaging accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound Request to Messaging App Device-Link Authorization Path
id: 79383b4b-ab3f-5a36-8c35-3e592f8b0b25
status: experimental
description: 'Detects HTTP/HTTPS requests from endpoints to URL paths associated with
device-linking or QR-code authorization flows on commercial messaging platforms,
which RIS phishing campaigns abuse to bind an attacker device to a victim''s messaging
account. This rule targets the generic behavioral pattern (device-link/pairing endpoint
paths) rather than any specific campaign domain.
'
logsource:
category: proxy
detection:
selection:
c-uri|contains:
- /linkdevice
- /device-link
- /pair?code=
- /qr-link
condition: selection
falsepositives:
- Legitimate user-initiated device pairing/linking on a personal messaging account
- Security awareness testing or QA of messaging app pairing flows
level: low
tags:
- attack.t1566.002
- attack.initial-access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/resources-tools/resources/russian-intelligence-services-continue-target-commercial-messaging-applications
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs