Russian Intelligence Faked Support Texts to Steal Accounts

According to The Hacker News, Ukraine's Security Service (SSU) and the FBI have jointly uncovered a sustained Russian intelligence campaign targeting messaging accounts belonging to government officials, military personnel, politicians, and activists across Ukraine, Europe, and the US.

The method is straightforward and effective. Attackers send SMS messages pretending to be the official support team for platforms like Signal and WhatsApp. The messages pressure targets into handing over account credentials, confirmation codes, or recovery keys.

This is social engineering (manipulating people rather than software to gain access) at its most targeted. The SSU linked similar campaigns to Russian threat groups including Star Blizzard and UNC5792, though it stopped short of attributing this specific operation to a named group.

If an attacker gets your recovery key, they can clone your messaging account to a device you have never seen. Every message you send or receive from that point forward goes to them too.

The FBI separately confirmed Russian intelligence is running a parallel phishing campaign aimed at tricking high-value targets into surrendering their backup recovery keys for commercial messaging apps.

What you should do: Open your Signal or WhatsApp settings and review all active linked devices right now. Remove anything you do not recognise. Enable two-factor authentication if you have not already, and never share confirmation codes, PINs, or recovery keys with anyone claiming to be platform support — the real support team will never ask for them.

Researchers at Mozilla's Zero Day Investigative Network have demonstrated an attack that leaves no malicious code anywhere a scanner could find it, according to Bleeping Computer.

Here is how it works. An attacker publishes a normal-looking GitHub repository. When an AI coding agent like Claude Code clones and sets up the project, a Python package deliberately throws an error and tells the agent to run a specific initialisation command. The agent, treating this as a routine setup problem, obeys. That command fetches instructions from a DNS TXT record (a configuration field attached to a domain name, controlled by the attacker) and executes them. The result: a reverse shell (a connection that gives the attacker live, interactive control of the victim's machine) running with the developer's own access rights.

The attacker gains access to API keys, environment variables, and local configuration files — all without ever putting a single suspicious line of code in the repository itself.

The researchers suggest AI agents should be required to disclose the full chain of commands they execute during setup, including anything fetched dynamically at runtime. Until that becomes standard, developers should manually review any repository before letting an AI agent run its setup scripts.

CVE ID not confirmed in source — check the original advisory before acting.

What Cisco Unified Communications Manager is: Cisco Unified Communications Manager (Unified CM) is enterprise software that manages phone calls, video conferencing, and messaging for large organisations — essentially the switchboard that ties all internal communications together.

What it is: According to a weekly roundup published by Help Net Security, a flaw in Cisco Unified CM is being actively exploited. The source does not supply the CVE ID, CVSS score, or specific patch version numbers. The full technical detail lives in the official Cisco advisory, which was not provided as a source for this issue.

Who's at risk: Organisations running Cisco Unified CM as part of their enterprise communications infrastructure. Active exploitation means attackers are not waiting — if your organisation uses this product, treat this as urgent.

CVSS: Not confirmed in available source — treat as High until the official advisory is reviewed.

Root cause: Insufficient detail is available from the source to describe the root cause with accuracy. Speculating on the flaw mechanism without a confirmed advisory would be irresponsible — check the Cisco Security Advisories portal directly.

Attack vector: Unknown from available source. The Help Net Security roundup confirms active exploitation is occurring but does not describe the attack method. Consult the official Cisco advisory for specifics.

Detection strategies:

1. Review authentication and access logs on your Unified CM servers for unexpected login attempts or privilege escalation events.
2. Monitor network traffic for unusual connections to or from Unified CM nodes, particularly outbound to unfamiliar external addresses.
3. Check whether any new admin accounts have appeared in your Unified CM configuration without a corresponding change request.

Recommended actions:

1. Visit the Cisco Security Advisories portal and search for the latest Unified Communications Manager advisory to obtain the confirmed CVE ID, CVSS score, and patch version.
2. Apply the vendor-recommended patch immediately given confirmed active exploitation.
3. Restrict administrative access to Unified CM to trusted internal IP ranges while patching is underway.

Fake support messages from Russian intelligence have put messaging account security back in the spotlight, and the fix does not require any special software.

Both Signal and WhatsApp let you see every device your account is currently linked to. If an attacker has used a stolen recovery key or confirmation code to link your account to their device, it will show up here.

On Signal: Go to Settings → Linked Devices. Remove anything unfamiliar.

On WhatsApp: Go to Settings → Linked Devices. Review the list and tap any unrecognised session to remove it.

While you are there, enable two-step verification on both apps. Signal: Settings → Account → Two-Step Verification. WhatsApp: Settings → Account → Two-Step Verification.

This takes under five minutes. The SSU advisory behind this story is available via The Hacker News if you want the full detail on how the campaign operates.

The education sector logged 1,252 data breaches last year, according to Verizon's 2026 Data Breach Investigations Report, with 65% of malware-related attacks involving ransomware. The core problem, as Dark Reading reports, is third-party software risk. A single breach of a widely used platform can hit thousands of schools at once — as happened with Canvas and MOVEit.

For schools and universities, the regulatory implication is clear: vendor contracts must include security requirements and breach notification terms. If your institution relies on third-party platforms, ask your vendors what their incident response plan looks like — before you need to find out the hard way.