Russian State Actors Target Signal, WhatsApp

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, Russian state hackers targeted Signal and WhatsApp users in a social engineering campaign, criminals impersonated U.S. city officials in permit-fee phishing scams and attackers used ClickFix tactics on compromised WordPress sites. Microsoft patched more than 80 vulnerabilities, researchers uncovered a botnet hijacking 14,000 routers for a proxy network. Polish police detained teenagers linked to DDoS-for-hire tools and Finnish intelligence warned of growing espionage by Russia and China. Also, North Korea coders for hire, openly this time.

See Also: Why Cyberattackers Love ‘Living Off the Land’

Russian nation-state hackers are running a global cyber campaign aimed at hijacking Signal and WhatsApp accounts used by government officials, military personnel and other high-value targets, Dutch intelligence agencies said Monday.

The Netherlands’ General Intelligence and Security Service and Military Intelligence and Security Service said the campaign targets individuals through social engineering and phishing attacks.

In many cases, hackers impersonate a Signal Support chatbot and trick users into sharing verification or PIN codes needed to register their accounts on another device. Another technique abuses the apps’ linked devices feature, allowing attackers to connect additional devices to accounts and read messages without alerting victims. Once access is established, threat actors can view private conversations and group chats.

“To be clear: Signal’s encryption and infrastructure have not been compromised and remain robust. These attacks were executed via sophisticated phishing campaigns, designed to trick users into sharing information – SMS codes and/or Signal PIN – to gain access to users’ accounts,” wrote Signal on social media network Bluesky.

Dutch authorities said the operation likely already exposed sensitive information. Signal’s strong reputation for end-to-end encrypted communications makes it a particularly attractive target for cyberespionage.

Germany’s domestic intelligence agency published a similar advisory weeks earlier, warning that unknown threat actors were conducting phishing campaigns via messaging platforms such as Signal, targeting politicians, diplomats, military personnel and journalists. The German advisory described attackers impersonating trusted contacts and attempting to obtain account credentials or security PINs to hijack messaging accounts.

Google observed Russian hackers using the same technique on Ukrainian targets in February 2025 (see: Ukrainian Signal Users Fall to Russian Social Engineering).

Cybercriminals are impersonating U.S. city and county officials in phishing emails that attempt to trick permit applicants into paying fraudulent planning and zoning fees, the FBI warned Monday.

The campaign targets individuals and businesses with active land-use permit applications. Victims receive unsolicited emails referencing legitimate permit details such as property addresses, zoning application numbers and project information, making the messages appear credible.

The emails typically claim that additional permit-related fees are due and include invoices or payment instructions. Recipients are directed to transfer funds using wire payments, peer-to-peer payment services or cryptocurrency – methods that are difficult to trace or reverse once completed.

Several indicators can reveal the scam. Messages often originate from non-government domains such as “@usa.com,” and some include attachments directing recipients to request payment instructions via email. The emails may also emphasize urgency, warning that unpaid fees could delay permit approvals.

Cybercriminals are weaponizing compromised WordPress websites as part of a global ClickFix malware distribution operation delivering information-stealing malware, Rapid7 warned.

Researchers say attackers compromise legitimate WordPress sites and inject malicious JavaScript designed to intercept visitors before they can access the site’s content. Instead of silently redirecting users, the injected code presents a fake Cloudflare verification page that closely mimics routine CAPTCHA checks commonly seen across the web.

Visitors are instructed to complete the verification by copying and pasting a command into the Windows Run dialog box. The tactic, known as ClickFix, tricks users into executing the malware themselves. By relying on manual command execution rather than file downloads, the technique can bypass traditional security tools that typically focus on scanning downloaded files.

Researchers say the campaign primarily targets Windows systems. The payloads delivered include Vidar Stealer, Impure Stealer, VodkaStealer and the DoubleDonut loader – all capable of harvesting browser credentials, authentication cookies, cryptocurrency wallet data and other sensitive information from infected devices. Stolen data may be used directly for financial theft or sold on underground marketplaces.

Rapid7 describes the campaign as “likely part of an organized long-term criminal effort,” active since December 2025, with some infrastructure dating back to July 2025. Researchers say the likely initial access vectors include default or weak administrator credentials and unpatched WordPress themes and plugins with widely available exploits, though the exact method has not been definitively confirmed. Once inside, attackers inject the ClickFix script without otherwise visibly altering the site, making the compromise difficult for site owners to detect.

The injected JavaScript is heavily obfuscated, helping the attack blend into otherwise legitimate website traffic and evade traditional detection tools.

Rapid7 has so far identified more than 250 compromised websites across at least 12 countries. The abuse of legitimate sites gives attackers a scalable and trusted malware delivery channel that is less likely to raise suspicion than newly registered malicious domains.

Microsoft on Tuesday patched more than 80 vulnerabilities across Windows, Microsoft Office, SQL Server, .NET and Azure components, including two publicly disclosed zero-day flaws, as part of a monthly dump of fixes.

The two disclosed zero-days are CVE-2026-21262, an elevation-of-privilege flaw in SQL Server and CVE-2026-26127, a denial-of-service vulnerability in .NET. The SQL Server flaw could allow an authenticated attacker to gain SQLAdmin privileges over a network, while the .NET bug could enable an attacker to disrupt services through an out-of-bounds read.

Microsoft also patched two critical Office remote code execution flaws – CVE-2026-26113 and CVE-2026-26110 – which can be triggered simply by viewing a malicious message in the Preview Pane.

More than half of the vulnerabilities involve privilege escalation, with several rated “exploited more likely,” including CVE-2026-24291, CVE-2026-24294, CVE-2026-24289 and CVE-2026-25187.

Another standout is CVE-2026-21536, a critical RCE flaw in Microsoft Devices Pricing Program that Microsoft already mitigated server-side.

A newly identified botnet dubbed “KadNap” compromised more than 14,000 routers and edge networking devices, turning them into a distributed proxy network used to relay malicious traffic and conceal cybercriminal activity, researchers at Lumen say.

The malware has been active since at least August 2025, targeting primarily Asus routers and other small office, home office devices by exploiting unpatched vulnerabilities. Once infected, devices are enlisted into a botnet that routes traffic through compromised residential IP addresses.

KadNap stands out for its decentralized command-and-control architecture. Instead of relying on traditional centralized servers, the malware uses a customized version of the Kademlia’s distributed hash table protocol to locate other nodes and command infrastructure.

This peer-to-peer approach makes the botnet harder to detect and disrupt because infrastructure details are spread across infected devices rather than concentrated in a single location.

Researchers say the compromised routers are being marketed through a proxy service called Doppelgänger, believed to be a rebrand of the Faceless proxy network, offering anonymous residential proxies in more than 50 countries. Most infected devices are located in the United States, accounting for about 60% of observed victims, with additional infections across Taiwan, Hong Kong, Russia and several European countries.

Polish police detained seven teenagers suspected of developing and selling tools used to launch distributed denial-of-service attacks.

Officers from Poland’s Central Bureau for Combating Cybercrime say the group created and distributed services that allowed customers to overwhelm targeted websites and servers with traffic. The tools were marketed online and designed so even users with little technical expertise could launch attacks.

The suspects range from early teens to late teens, with the youngest reportedly to be 12. The teens allegedly profited by selling access to the tools used in attacks on popular websites.

“Booter” or “stresser” services enable customers to select a target, choose the type and duration of attack, and trigger a flood of malicious traffic for a fee. The platforms lower the barrier to entry for cybercrime by turning DDoS attacks into a point-and-click service.

Finland is facing sustained espionage and influence operations from Russia and China, with cyber activity and intelligence targeting expected to intensify, according to an assessment by the Finnish Security and Intelligence Service, or Supo.

Russia remains the primary intelligence threat to Finland, with its services seeking information on Finnish foreign policy, NATO membership, border policy and critical infrastructure, the agency said. Russia has diversified its intelligence methods, increasingly relying on proxy actors and remotely recruited individuals to conduct activities such as sabotage or information gathering.

Despite expulsions of intelligence officers from European countries in recent years, Russian services continue attempts to place operatives in diplomatic missions, where diplomatic immunity provides cover for intelligence work and relationship-building with potential sources.

Chinese intelligence operations are also expanding in Finland, combining cyberespionage with influence campaigns. Supo said China maintains a long-term intelligence interest in the country, targeting foreign policy decision-making, Arctic issues and cutting-edge technologies such as artificial intelligence and quantum computing.

Chinese authorities also conduct what the Supo describes as “refugee espionage,” monitoring and attempting to influence Chinese citizens and dissidents living abroad. These operations aim to gather intelligence and discourage criticism of the Chinese government.

Cyber operations linked to China increasingly target Western critical infrastructure and exploit poorly secured consumer network devices, including home routers, to build o-called shadow networks and launch attacks while disguising their origin.

The agency said espionage campaigns often combine cyber intrusions, human intelligence recruitment and influence operations aimed at shaping policymaking and public debate.

Would you knowingly hire a North Korean coder? The tyrannical regime’s efforts to fraudulently obtain its IT workers in Western firms under false pretenses is well-known at this point (see: How to Spot a North Korean Job Candidate).

But according to a blogger Nick Roy, who closely tracks the Hermit Kingdom at North Korean Internet, Pyongyang is also openly shopping its IT workers. An email discovered in late 2025 markets North Korean workers to the Middle Eastern and North African telecom markets, Roy wrote Tuesday.

Among the services being marketed by North Korea: Android app hardening to prevent reserve engineering and an Android surveillance platform. The country is also pitching its coders as AI code slingers capable of developing “image processing including facial recognition, license plate recognition, eye monitoring, people counting, fire and smoke detection, web development and software engineering,” Roy wrote.

“The covert IT worker scheme gets most of the attention and for good reason. However this email documents another strategy by the regime for earning foreign currency,” he added.

Other Stories From This Week

With reporting by Information Security Media Group’s David Perera in Northern Virginia