# Russian intel targets messaging apps in phishing campaigns

Published: 2026-06-26 · Severity: high
Canonical: https://vorant.io/reports/6069ad80-d83d-5414-aa1c-efceb0611b2a/russian-intel-targets-messaging-apps-in-phishing-campaigns

> CISA and FBI warn that Russian Intelligence Services are actively targeting commercial messaging applications through ongoing phishing campaigns, updating 2026 guidance with new tactics.

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have issued an updated Public Service Announcement warning of continued targeting of commercial messaging applications by Russian Intelligence Services (RIS) cyber threat actors. The activity involves ongoing phishing campaigns designed to compromise accounts on commercial messaging platforms.

This advisory updates previous guidance from March 2026, incorporating recent tactics observed in the wild along with recommended mitigations and samples of phishing messages used by RIS actors. The continued focus on commercial messaging applications suggests these platforms remain a priority intelligence collection vector for Russian state-sponsored actors.

Organizations using commercial messaging applications for business communications should review the updated guidance and implement recommended security controls. The persistent nature of these campaigns indicates a sustained operational priority by Russian intelligence services to gain access to communications on these platforms.

## Mentioned in this report

- Threat actors: Russian Intelligence Services

## Detection guidance (public sample)

### OAuth Device Code Authentication Flow Sign-In

ATT&CK: T1078

Detects sign-ins using the OAuth device code authentication flow, a technique abused in RIS phishing campaigns that trick users into authorizing an attacker-controlled session or linked device. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: OAuth Device Code Authentication Flow Sign-In
id: 88723322-c31d-5f21-9225-d154a30ce791
status: experimental
description: 'Detects successful authentications that use the OAuth device code flow.
  Russian Intelligence Services (RIS) actors have used device-code and device-linking
  phishing lures to trick users into authorizing attacker sessions on commercial messaging
  and cloud platforms, granting persistent access without needing the victim''s password.

  '
references:
- CISA/FBI PSA on RIS targeting of commercial messaging applications
logsource:
  category: authentication
  product: azure
  service: signinlogs
detection:
  selection:
    AuthenticationProtocol: deviceCode
  filter:
    ClientAppUsed|contains:
    - Microsoft Authentication Broker
    - Company Portal
  condition: selection and not filter
falsepositives:
- Legitimate use of device code flow for headless/IoT devices or CLI tools (e.g.,
  Azure CLI, PowerShell login on servers without browser)
- Enterprise-managed device onboarding via device code flow
level: medium
tags:
- attack.t1078
- attack.initial_access
author: Vorant
```

### New Device or Session Linked to Messaging/Cloud Account Shortly After Authentication

ATT&CK: T1078

Detects a new device or trusted session being registered to a user account, consistent with RIS phishing lures (e.g. malicious QR codes or device-linking links) that add an attacker device to a compromised messaging account for persistent read access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: New Device or Session Linked to Account After Authentication
id: 821cb855-c7c3-53dd-a2ae-9c8fbaa20408
status: experimental
description: 'Detects audit events where a new device is registered or linked to a
  user''s account. RIS actors have used phishing messages containing malicious QR
  codes or ''linked device'' invitations for commercial messaging apps to add an attacker-controlled
  device to a victim''s account, enabling persistent access to communications without
  further credential use.

  '
references:
- CISA/FBI PSA on RIS targeting of commercial messaging applications
logsource:
  category: application
  product: azure
  service: audit
detection:
  selection:
    OperationName|contains:
    - Register device
    - Add registered owner to device
    - Approve device
  condition: selection
falsepositives:
- Legitimate employee registering a new personal or corporate device through normal
  enrollment workflows
- IT helpdesk-assisted device onboarding
level: medium
tags:
- attack.t1078
- attack.persistence
author: Vorant
```

### Phishing Link Click Leading to Messaging App Authorization Page

ATT&CK: T1566.002

Detects outbound web requests to external URLs containing device-linking or authorization-flow paths for commercial messaging platforms, consistent with spearphishing links used by RIS actors to hijack messaging accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Outbound Request to Messaging App Device-Link Authorization Path
id: 79383b4b-ab3f-5a36-8c35-3e592f8b0b25
status: experimental
description: 'Detects HTTP/HTTPS requests from endpoints to URL paths associated with
  device-linking or QR-code authorization flows on commercial messaging platforms,
  which RIS phishing campaigns abuse to bind an attacker device to a victim''s messaging
  account. This rule targets the generic behavioral pattern (device-link/pairing endpoint
  paths) rather than any specific campaign domain.

  '
logsource:
  category: proxy
  product: windows
detection:
  selection:
    c-uri|contains:
    - /linkdevice
    - /device-link
    - /pair?code=
    - /qr-link
  condition: selection
falsepositives:
- Legitimate user-initiated device pairing/linking on a personal messaging account
- Security awareness testing or QA of messaging app pairing flows
level: low
tags:
- attack.t1566.002
- attack.initial_access
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/resources-tools/resources/russian-intelligence-services-continue-target-commercial-messaging-applications

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6069ad80-d83d-5414-aa1c-efceb0611b2a/russian-intel-targets-messaging-apps-in-phishing-campaigns.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup