Russian Hackers Launch Mass Attacks on WhatsApp and Signal

Russian hackers are taking over WhatsApp and Signal accounts en masse. Dutch government employees are among the victims. Google has revealed DarkSword, which silently attacks iPhones, steals data, and then cleans up its tracks after a few minutes. The popular Trivy scanner has turned against its own users, and a 30-year-old vulnerability in telnetd with CVSS 9.8 is still running on thousands of devices.

The American FBI, together with CISA, the Dutch intelligence services AIVD and MIVD, and the French Cyber Crisis Coordination Centre (C4) under the ANSSI agency, are warning about an extensive phishing campaign linked to Russian intelligence services that targets Signal and WhatsApp accounts worldwide.

The campaign does not focus on breaking encryption or exploiting technical vulnerabilities in the applications themselves. Instead, the attackers are betting on the human factor. They impersonate non-existent technical support, such as “Signal Support Bot” or “Signal Security Chatbot”, and contact victims directly within the app. Through fake messages about suspicious account activity or alleged data leaks, they attempt to trick users into revealing their verification SMS codes and security PINs. Once they obtain these credentials, they can fully take over the account.

Dutch intelligence services confirmed that victims include employees of the Dutch government, and warned that the attackers likely gained access to sensitive information.

“Despite end-to-end encryption, applications like Signal and WhatsApp should not be used for sharing classified, confidential, or otherwise sensitive government information,” added the director of the Dutch Military Intelligence Service, Vice Admiral Peter Reesink.

A similar warning was issued by the Portuguese security service SIS, which pointed out that attackers are increasingly using artificial intelligence tools to impersonate technical support or trusted contacts, including convincingly sounding voice and video calls.

Signal emphasized on the social network X that its encryption and infrastructure remain uncompromised and that its support never contacts users through in-app messages or social media requesting verification codes.

DarkSword: New Exploit Threatens Hundreds of Millions of iPhones

Security researchers from Google, Lookout, and iVerify this week published a detailed analysis of a previously unknown exploit chain called DarkSword, which has been actively targeting iPhones running iOS versions 18.4 through 18.7 since the fall of 2025.

Technically, it is a sophisticated multi-stage attack. It all begins with a malicious iframe element embedded in a web page that triggers JavaScript code in the Safari browser. This first exploits a vulnerability in JavaScriptCore to gain remote access. DarkSword then bypasses the browser security sandbox through a vulnerability in the WebGPU graphics interface and then moves into the system process mediaplaybackd. From there, it gains access to the operating system kernel and can read and write to memory at the kernel level.

After successful privilege escalation, it deploys a module that coordinates a series of malicious components focused on collecting and exfiltrating data. From passwords, emails, and messages from apps like iMessage, WhatsApp, or Telegram to location history, photos, cryptocurrency wallet data, and credentials stored on the device. Researchers point out that the entire process operates using a “smash and grab” method. Data is stolen within minutes and the malware cleans up its traces.

What is particularly noteworthy about the DarkSword exploit is that it is being used by several independent threat actor groups with different motivations.

The first to deploy it in November 2025 was a previously unknown group designated as UNC6748, which targeted users in Saudi Arabia through a fake website impersonating Snapchat.

Shortly after, DarkSword was detected in campaigns linked to the Turkish commercial surveillance software vendor PARS Defense, which used it against targets in Turkey and Malaysia.

The most concerning activity, however, comes from the group UNC6353, likely linked to Russian intelligence services, which has been using DarkSword since December 2025 in attacks against Ukrainian users. This group had previously also used the related exploit Coruna, which was discovered just two weeks before DarkSword.

Apple has already patched all six vulnerabilities exploited by DarkSword.

TeamPCP Group Turned the Security Tool Trivy into a Weapon Against Developers

On March 19, 2026, attackers compromised the popular open-source vulnerability scanner Trivy by Aqua Security. Malicious code was injected directly into official releases and GitHub Actions that are used daily by thousands of development teams worldwide.

The roots of the entire incident trace back to the end of February 2026, when an autonomous bot called hackerbot-claw exploited a misconfigured GitHub Actions workflow in the Trivy repository.

The maintainers did respond and rotated the compromised credentials, but the process was not thorough and some tokens remained active. This is exactly what the group calling itself TeamPCP exploited when, on March 19, using still-valid access credentials, they launched a second, far more devastating attack. The attackers overwrote 75 out of 76 version tags in the aquasecurity/trivy-action repository to point to malicious commits containing an infostealer written in Python.

The insidiousness of the entire attack lay in its stealth. The malicious script ran before the legitimate Trivy scan and then let the scan complete normally. Developers saw no issues in the logs.

Meanwhile, the malware operated in three phases. First, it collected sensitive data such as SSH keys, login credentials for cloud services AWS, GCP, and Azure. Then it encrypted the data using AES-256 and RSA-4096, and finally exfiltrated it to the attackers’ server via a typosquatted domain that imitated the official Aqua Security website.

The consequences of the attack did not stop at Trivy itself. The attackers used the stolen data for further compromises into the npm ecosystem, and through stolen tokens, a self-replicating worm spread.

All organizations that ran Trivy through the compromised versions between March 19 and 20, 2026, should immediately rotate all secrets in their CI/CD environments and check whether any unauthorized repositories have been created in their GitHub organizations.

Critical Vulnerability in Telnetd Allows Remote Code Execution

Security researchers from the Israeli company Dream Security discovered a severe flaw in the telnetd daemon. The vulnerability, designated as CVE-2026–32746, received a CVSS score of 9.8 out of 10.

The vulnerability lies in how telnetd processes so-called SLC triplets during the initial phase of a Telnet connection. The add_slc function writes three bytes for each SLC triplet into a fixed 108-byte buffer without checking whether there is enough space remaining. After approximately 35 triplets with function codes higher than 18, memory beyond the buffer boundary is overwritten.

Analysts from watchTowr Labs noted in their detailed analysis that this bug has existed in the code since 1994, for more than thirty years.

Although the vulnerability formally affects only GNU InetUtils, many software vendors over the years adopted the same code into their own implementations. Confirmed affected systems include FreeBSD, NetBSD, Citrix NetScaler, Haiku, TrueNAS Core, uCLinux, libmtev, and DragonFlyBSD.

According to data from the Censys platform, approximately 3,362 hosts with this daemon were exposed on the internet as of March 18, 2026.

Although Telnet is generally considered an outdated protocol that was long ago replaced by encrypted SSH, the reality is far more complex. The protocol remains deeply embedded in industrial control systems and is often the only interface for remote management.