A massive Russian intelligence operation is bypassing end-to-end encryption by targeting the human element through sophisticated session-hijacking.
How session hijacking bypasses end-to-end encryption
Signal and WhatsApp encrypt messages so that only the devices in a conversation can read them. That protection holds for content on the wire and at rest on the providers’ servers. It does not protect the unlocked session on a phone or computer that already holds the keys. Session-hijacking campaigns exploit that boundary: if an attacker can take over a live session, they read and send messages as the victim without breaking the cryptography itself.
The usual path is social engineering, not a math attack. Operators impersonate trusted contacts, IT support, or security staff and push the target to approve a new device, share a login code, scan a QR code, or install software that captures session tokens. Once that session is linked, traffic looks legitimate to the apps and to the network. End-to-end encryption still works—it simply protects the attacker’s access as thoroughly as the user’s.
Why messaging apps are attractive targets
Secure messengers concentrate high-value contact graphs, operational coordination, and private media in one place. Intelligence-focused phishing often aims less at cracking a single ciphertext and more at long-lived access to those conversations. A hijacked session can persist until the victim notices a new linked device, revokes sessions, or changes primary credentials. That window is enough for surveillance, influence, or further compromise of people in the same chat threads.
Campaigns attributed to Russian intelligence activity have repeatedly mixed believable pretexts with technical steps that look like normal app setup. The human element is the weak point: urgency, authority, fear of account loss, and the habit of tapping “allow” when a familiar brand appears on screen.
Practical defenses that actually reduce risk
Defenses work best when they assume a convincing lure will eventually land. Treat unexpected requests to re-link a device, share a code, or “verify” an account as hostile until proven otherwise—even when the message appears to come from a known contact whose own device may already be compromised.
- Review linked devices regularly in Signal and WhatsApp settings and remove anything you do not recognize.
- Never share SMS or in-app verification codes, QR pairing codes, or backup keys with anyone who contacts you first.
- Prefer out-of-band confirmation (a call you initiate, or a pre-agreed phrase) before approving device changes.
- Enable available lock and registration protections so a stolen SIM or code alone is not enough to take over the account.
- Keep the OS and apps updated, and avoid sideloaded “security” tools promoted in the same lure chain.
If compromise is suspected, revoke all sessions, reinstall only from official stores if device integrity is in doubt, re-register carefully, and notify sensitive contacts that prior messages and identity claims from that account may not be trustworthy.
What teams and individuals should change in process
Organizations that rely on Signal or WhatsApp for sensitive work need clear policy: no device linking under pressure, dual control for admin-like account changes where possible, and a short checklist for reporting suspected hijack. Training should show real pairing and code-prompt flows so people recognize them under stress. Logging and light monitoring of “new device linked” events help when accounts are managed at scale.
The lesson is operational, not cryptographic. Strong encryption does not replace session hygiene, skepticism toward unexpected setup steps, and fast recovery when a session may already belong to someone else. Treat the device session as the crown jewel: protect approval paths as carefully as passwords, and assume sophisticated phishing will keep aiming at the human who can hand those sessions over.