Global Security Alert: State Hackers Escalate Attacks on WhatsApp and Signal Messaging Apps

In a stark warning to the public, the UK’s National Cyber Security Centre (NCSC) has raised the alarm over a significant surge in sophisticated cyber-attacks. The primary targets? Popular messaging applications like WhatsApp, Facebook Messenger, and Signal. This coordinated campaign, attributed to state-aligned actors, marks a dangerous shift in how sensitive information is being hunted in the digital age.

Consequently, the threat landscape for personal communication has fundamentally changed. The NCSC’s alert, issued in coordination with international partners, points directly to “growing malicious activity from Russia-based actors.” However, this is not an isolated threat. The agency has previously documented similar operations by China’s APT31 and groups linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), painting a picture of a widespread, global espionage effort.

Who is in the Crosshairs of Messaging App Security Threats?

This wave of attacks is highly targeted, not random. The NCSC defines the primary victims as “high-risk individuals”—those whose professional roles or public profiles grant them access to sensitive data or influential networks. This includes government officials, politicians, journalists, academics, and legal professionals. The objective is clear: compromise a single device to gain a foothold into a wider, valuable network of contacts and confidential communications.

Building on this, the Dutch intelligence service has echoed these concerns, independently warning about Russian hackers specifically focusing on WhatsApp and Signal accounts. This international consensus underscores the severity and coordinated nature of the threat.

The Hacker’s Playbook: Social Engineering and Deception

So, how are these attacks executed? The techniques are cunningly simple yet effective, relying heavily on human psychology rather than complex code. Attackers deploy a range of tricks designed to bypass technical safeguards. These include sending malicious links or QR codes that stealthily install malware or steal login credentials. A common ploy involves impersonating a trusted contact to trick users into sharing account recovery codes. Another method sees hackers silently joining group chats to monitor discussions and identify further targets.

As a result, the NCSC emphasizes a critical point: “anyone can be the victim of social engineering.” The perception that only the technically naive are at risk is a dangerous misconception. The professional and personal blending of communications on these platforms makes everyone a potential target.

Essential Defenses for Your Messaging App Security

In response to this escalating threat, the NCSC and security experts have outlined clear, actionable steps to bolster your defenses. Adopting these practices is no longer optional for those in sensitive positions; it is a necessary component of modern digital hygiene.

First and foremost, treat messaging apps with caution. Avoid sharing highly sensitive information through these channels. Where possible, use organization-provided devices and sanctioned communication services for work-related discussions and adhere strictly to corporate security policies. This creates a vital separation between personal and professional digital footprints.

Furthermore, guard your authentication details fiercely. Never share verification codes sent via SMS or app, and be extremely wary of scanning unexpected QR codes—a favorite tool of attackers. Enabling multi-factor authentication (MFA) adds a crucial extra layer of security, making account takeover significantly harder.

Finally, make regular audits a habit. Periodically check your app settings for any unfamiliar linked devices, and scrutinize the members of your group chats. Remove or independently verify any participant you do not recognize. For more on securing your digital identity, read our guide on protecting personal data online.

The Bigger Picture: Why Messaging Apps Are Prime Targets

Andy Ward, senior VP at Absolute Security, contextualizes the threat. “Messaging apps like WhatsApp are now embedded in both our personal and professional lives, which is why they are a prime target,” he states. “Individuals with confidential and sensitive data are at the forefront of a cybercriminal’s aim.”

This integration is precisely the vulnerability. The same app used for family chats often contains work-related conversations, creating a treasure trove of data. Therefore, the boundary between personal convenience and professional security has dangerously blurred.

To address this, Ward advocates for a proactive and resilient security posture. “Organizations and government alike must be monitoring devices and applications to prevent incoming threats as well as helping to recover when the inevitable attack happens,” he adds. This means moving beyond simple prevention to assume that some breaches will occur and having robust response plans ready. Learn about implementing such plans in our article on cyber incident response basics.

In summary, the NCSC’s alert is a powerful reminder that our most common communication tools are now front-line assets in global cyber espionage. By understanding the threat, recognizing the targets, and implementing disciplined security practices, individuals and organizations can significantly reduce their risk in this new era of digital conflict.

Major EU Data Breach: How Hacking Gangs TeamPCP and ShinyHunters Compromised Commission’s Cloud

The European Union’s cybersecurity landscape has been rocked by a significant incident. In a detailed report, the EU’s Computer Emergency Response Team (CERT-EU) has formally attributed a massive data breach affecting the bloc’s executive body to coordinated actions by two distinct cybercriminal groups. This EU data breach underscores a growing trend of sophisticated, multi-stage attacks targeting critical infrastructure.

The Anatomy of the Attack: A Two-Gang Operation

According to the agency’s findings, the incident was not the work of a single entity. Instead, it involved a chain of events initiated by one group and capitalized on by another. The initial intrusion is credited to a group known as TeamPCP. This group managed to compromise a critical Amazon Web Services (AWS) account used by the European Commission. From this account, they exfiltrated approximately 92 gigabytes of compressed data.

This stolen data, which included sensitive personal information such as names, email addresses, and the contents of emails, was later published online. However, the publication was carried out by a separate, notorious entity: the ShinyHunters hacking group. This dual attribution for a single breach event is a notable development in cyber threat analysis, highlighting complex digital crime ecosystems. A member of ShinyHunters later claimed they had obtained and leaked data that TeamPCP had stolen in earlier operations.

Exploiting the Supply Chain: The Trivy Tool Compromise

So, how did the attackers gain their initial foothold? The breach traces back to March 19. CERT-EU’s investigation reveals that hackers first targeted an open-source security tool named Trivy. Following a compromise of the Trivy project itself, the European Commission inadvertently downloaded a tainted version of this very tool meant to protect its systems.

This compromised tool contained malicious code that allowed TeamPCP to steal a secret API key. Possession of this key was the master stroke. It granted the attackers direct access to the Commission’s AWS cloud infrastructure, specifically the Europa.eu platform used to host official websites and publications. Consequently, they could pivot freely within the system to locate and steal vast amounts of data. For more on securing development tools, read our guide on open-source security best practices.

The Scope and Impact of the Data Exposure

The ramifications of this EU data breach are extensive. The 92GB cache of data is just the starting point. CERT-EU warns that the breach potentially affects the cloud infrastructure of at least 29 other EU entities. Dozens of internal European Commission clients may also have had their data stolen.

Within the published data, analysts found close to 52,000 files containing sent email messages. While many of these are automated system emails with little sensitive content, a significant risk remains. Emails that bounced back with delivery errors likely contain the original user-submitted content in full. This poses a direct and serious risk of personal data exposure for countless individuals who interacted with EU institutions.

A Pattern of Malicious Activity

This incident is not an isolated event for the involved groups. Security researchers, including Aqua Security (the developer of Trivy) and Palo Alto Networks Unit 42, have linked TeamPCP to a broader campaign of supply chain attacks. Their modus operandi involves compromising open-source security projects to gain access to the developers and organizations that use them.

By stealing credentials and API keys from developers, these hackers gain keys to far more sensitive systems. As Unit 42 noted, this access provides them “the ability to hold compromised organizations for ransom, demanding extortion payments,” linking their activities to ransomware and crypto-mining campaigns. Understanding these supply chain threats is crucial for modern defense.

Response and Ongoing Analysis

In the wake of the breach, what is being done? CERT-EU has confirmed it is actively engaged with all affected organizations to manage the fallout and bolster defenses. The agency continues to analyze the full dataset that was leaked online to understand the complete scope of the exposure.

Meanwhile, a spokesperson for the European Commission stated the body was closed at the time of the report and would provide further comment later. This incident serves as a stark reminder of the vulnerabilities inherent in complex digital supply chains, where a single compromised tool can cascade into a continent-scale data disaster.

Ultimately, this breach illustrates a critical evolution in cyber threats. It’s no longer just about breaking in; it’s about manipulating the very tools of defense to enable the theft. For EU institutions and organizations worldwide, the lesson is clear: vigilance must extend beyond perimeter security to encompass every link in the software development and deployment chain.

The Storm Infostealer: A New Era of Remote Credential Theft

A dangerous evolution in credential theft has emerged from the digital shadows. Security analysts at Varonis have identified a sophisticated new Storm infostealer that operates with a chilling efficiency. Instead of risking detection by decrypting stolen data on a victim’s computer, this malware quietly packages everything and ships it off to the attacker’s own servers. This fundamental shift makes traditional endpoint defenses far less effective, marking a significant escalation in the cybercrime arms race.

How Storm Infostealer Evades Detection

To understand Storm’s threat, we must first look at what came before. Historically, information stealers worked locally. They would infiltrate a system, load libraries to access browser databases, and decrypt saved passwords and cookies right there on the victim’s machine. This activity, however, left clear footprints—processes accessing sensitive files, unusual network calls—that modern security tools learned to recognize and block.

Then, the landscape changed. Building on this, major browsers like Google Chrome introduced stronger, app-bound encryption. This made local decryption incredibly difficult, forcing malware authors to find new methods. Initial workarounds involved complex code injection or abusing debugging features, but these too left traces for vigilant security software to find.

The Remote Decryption Advantage

Therefore, the creators of Storm adopted a radically different approach. The malware acts as a sophisticated collector. It harvests encrypted credential files, session cookies, autofill data, and even credit card information directly from the browser’s secure storage. Crucially, it does not attempt to crack them open locally. Instead, it transmits the encrypted loot back to a command server controlled by the attacker. The decryption happens safely in the attacker’s own environment, completely bypassing the victim’s antivirus and endpoint detection systems. This server-side processing is a core reason why the Storm infostealer is so concerning to experts.

What Does the Storm Infostealer Steal?

The breadth of data targeted by Storm is comprehensive, designed to give attackers maximum leverage. After infection, it systematically collects a victim’s entire digital identity. This includes saved passwords, active session cookies, browsing history, and Google account tokens. Furthermore, it captures autofill data and stored credit card details. One compromised browser can hand an attacker the keys to corporate SaaS platforms, internal tools, and cloud environments without ever triggering a single password alert.

In addition to browser data, Storm casts a wider net. It scours user directories for documents, captures system information and screenshots, and extracts session data from popular messaging apps like Telegram, Signal, and Discord. Perhaps most alarmingly for some, it specifically targets cryptocurrency wallets, pilfering data from both browser extensions and dedicated desktop applications. According to researchers, all this activity runs directly in the computer’s memory to minimize its footprint and further reduce the chance of detection.

Automated Session Hijacking and Criminal Economics

Beyond mere data collection, Storm automates the next critical step: exploitation. Most stealers simply dump raw logs into a buyer’s panel, requiring manual effort to sift through and use the stolen credentials. Storm changes this equation. It automatically feeds stolen Google Refresh Tokens into its operator panel. Simultaneously, it provides a geographically matched SOCKS5 proxy. This combination allows the criminal to silently restore the victim’s authenticated session from a location that appears legitimate, enabling seamless account takeover and fraud.

On the criminal marketplace, this capability comes at a price. Varonis reports that access to the Storm infostealer is sold for less than $1,000 per month, making it an accessible tool for a wide range of threat actors. During their investigation, the company’s threat intelligence team identified 1,715 victim entries in Storm’s panel, with connections originating from countries including the United States, India, Brazil, Indonesia, Vietnam, and Ecuador. The diversity of network sources suggests active, widespread malicious campaigns.

High-Value Targets and the Broader Threat

The credentials stolen by Storm are not random. They are focused on high-value platforms that offer direct financial or strategic payoff. This includes major social media and communication giants like Facebook and Twitter/X. On the financial front, the malware aggressively targets leading cryptocurrency exchanges and services such as Coinbase, Binance, Blockchain.com, and Crypto.com.

Consequently, this stolen data fuels a thriving underground economy. Credentials are packaged and sold on dark web marketplaces, where they are used for everything from straightforward financial fraud and account resale to serving as the initial foothold for more advanced, targeted attacks against individuals and organizations. For more on protecting against such initial access threats, read our guide on endpoint security best practices.

Ultimately, the emergence of Storm signals a troubling trend toward more resilient and automated cybercrime tools. By moving the decryption process off the victim’s machine, attackers have found a way to neutralize a key defensive detection method. This development underscores the need for a layered security approach that includes robust network monitoring, user education on phishing threats, and advanced threat-hunting capabilities to identify anomalous data exfiltration, even when it’s encrypted. For deeper insights into the malware landscape, explore our analysis of the evolution of information stealers.