The FBI and CISA released a joint public service announcement today (PSA I-032026-PSA) warning of an ongoing phishing campaign by Russian Intelligence Services targeting commercial messaging applications, specifically Signal and WhatsApp.
The actors impersonate commercial message application support accounts to trick targets into sharing verification codes or scanning malicious QR codes, enabling linked device abuse or full account takeover.
Given the current geopolitical climate, please consider reviewing the FBI article in the references section. Phishing may serve as an initial access vector in a larger compromise, especially on personal devices linked to corporate accounts.
A recent article in The Register reports that cybercrime has surged 245% since the start of the Iran war. The Iranian conflict has provided cover for nation-states, allowing them to carry out activities while global attention is focused on Operation Epic Fury.
Recommendations
Review risky sign-in events flagged by Entra ID Identity Protection — focus on unfamiliar locations, atypical travel, and anomalous token activity
Watch for device code authentication flows, which Russian threat actors (Storm-2372) have used as a follow-on technique after social engineering
Pay attention to sign-ins from VPN exit nodes or anonymizing infrastructure, particularly for privileged accounts
For customers with BYOD policies, recommend auditing linked devices
If account compromise is confirmed or suspected, have the user immediately revoke all linked devices in the affected app and change their registration PIN.
Assess whether the compromised personal account was used to contact other individuals within the organization. If so, treat those contacts as potentially socially engineered and investigate their corporate accounts for signs of credential theft, rogue MFA registrations, or unusual sign-in activity.
Check whether the affected user has the same or similar passwords across their personal messaging accounts and corporate accounts. Credential reuse turns a personal app compromise into a corporate one.
Preserve Signal/WhatsApp message logs where possible before the user removes linked devices, as these may contain indicators of the phishing lure, attacker-controlled phone numbers, or QR code URLs useful for threat intelligence and IOC sharing.
References
Cybercrime has skyrocketed 245% since the start of the Iran war -https://www.theregister.com/2026/03/16/cybercrime_iran_war_245_percent_rise/
FBI Public Service Announcement (I-032026-PSA) — https://www.ic3.gov/PSA/2026/PSA260320