CISA and FBI: Russian Intelligence Services Continue to Target Commercial Messaging Applications

CISA and the FBI issued an updated public service announcement on June 26 warning that Russian Intelligence Services cyber threat actors are targeting commercial messaging applications in ongoing phishing campaigns, per the advisory posted to CISA's website.

The PSA updates a March 2026 announcement covering the same activity, per CISA, and adds recent tactics observed in the campaigns, recommended mitigations, and samples of the phishing messages used against targets.

Not specified in the available summary: which messaging applications are being targeted, named threat groups or intrusion sets, and victim counts. What is confirmed on the record is the joint agencies' assessment that the Russian Intelligence Services phishing activity first flagged in March 2026 is continuing; the agencies' stated next step for defenders is applying the updated mitigations in the PSA.

Background

Encrypted messaging applications have become a priority target for Russian state-linked operators because they carry exactly the communications that traditional network espionage misses. Security researchers have documented campaigns since Russia's full-scale invasion of Ukraine in which actors linked to Russian intelligence abused legitimate features of these apps — most notably device-linking, which lets an attacker who tricks a target into scanning a malicious QR code or clicking a crafted link mirror the victim's messages to a device the attacker controls, without malware and without breaking the encryption.

The technique's economy is what sustains it: phishing a user costs far less than exploiting a phone, and a linked device yields continuing access to conversations. Joint CISA-FBI public service announcements are the US government's standing channel for warning the general public, as distinct from technical advisories aimed at network defenders; issuing an update with fresh message samples three months after the original signals that the agencies assess the campaign as persistent and evolving rather than a contained episode.

What comes next

The agencies' operative guidance is for users of commercial messaging apps to apply the updated mitigations — typically scrutiny of linked devices, caution with QR codes and links, and platform security features. Watch for any subsequent technical advisory attributing the activity to named intrusion sets, or vendor-side changes to device-linking flows, which have followed comparable disclosures in the past.