Adversary Intelligence — 2026-08-31

FBI Proactively Contacts Thousands of Signal Users Compromised by Ongoing FSB Phishing Campaign

BLUFFBI's pivot to direct victim notification signals the bureau possesses a comprehensive compromise list that likely extends well beyond the journalists and officials publicly identified so far.

The FBI has notified thousands of Signal users that their accounts were compromised by an FSB phishing campaign, contacting SpyTalk journalist Jeff Stein directly by phone about a compromise he was previously unaware of 1. The FBI issued a public alert in March describing a global campaign that gained unauthorized access to thousands of messaging accounts by targeting officials, military personnel, political figures, and journalists 1. A follow-up FBI alert on June 26 identified FSB officers embedded with the FSB Border Guards, along with others working for Russian military services, as responsible for the operation 1. The European Union stated this week that attacks on Signal and other messaging apps, including WhatsApp, remain ongoing 1. The scheme used fake "Signal Support" messages warning targets their accounts would be deleted unless they entered their recovery key, which attackers then used to seize control of the account 1.

Analysis
The FBI's shift from public alert to direct phone outreach, including contacting a journalist previously unaware of his own compromise, indicates the bureau is working from an internal victim list broader than public reporting suggests and judges the campaign's scale warrants proactive notification over passive advisory. EU confirmation this week that attacks on Signal and WhatsApp remain active shows the operation persists past June's attribution to FSB Border Guard-embedded officers; single-source reliance on one journalist's derivative account of FBI alerts, with no independent law-enforcement or FSB-side confirmation, limits verification. The disclosure may equally reflect the FBI's interest in demonstrating press-community engagement amid criticism of its journalist outreach, rather than tradecraft necessity alone. Journalists using Signal for source protection face continued exposure absent changes to account security hygiene.

1 sources

How the Russians Got Inside My Phone - SpyTalk