The Security Service of Ukraine and FBI recently disclosed a sustained campaign in which Russian intelligence services sent fake SMS messages impersonating legitimate services—typically messaging platforms—to harvest credentials from government officials, military personnel, and political figures across Ukraine, Europe, and the United States. The operation succeeded not through zero-days or exotic exploits, but by social engineering at sufficient scale and targeting officials already under surveillance.
The Mechanism: Why SMS Impersonation Works at Scale
The attackers sent SMS messages designed to mimic legitimate platform notifications—"Verify your Telegram account", "Confirm your Signal login", and similar prompts. Recipients were directed to fake login pages that captured both username and password. The technique itself is not novel. What made this campaign notable was the operational discipline: attackers had already conducted reconnaissance on their targets, knew which messaging platforms they used, and timed the messages to coincide with periods when officials were likely to be switching devices or re-authenticating.
SMS remains attractive to attackers because it exists outside the security perimeter of most organisations. Unlike email, which organisations can filter, scan for phishing, and control access to, SMS arrives on personal phones and bypasses most corporate security infrastructure. Recipients are conditioned to trust SMS as a direct channel from their carriers, and the brevity of SMS messages leaves little room for visual inconsistencies that might trigger suspicion in longer phishing emails.
Authentication Weaknesses in Messaging Platforms
Messaging applications—Telegram, Signal, WhatsApp, and others—typically implement optional two-factor authentication, but the underlying credential exchange remains vulnerable. If an attacker obtains a valid username and password, they can often trigger a password reset, intercept SMS-based recovery codes, or in some cases log in directly. The authentication flow still relies on the assumption that the user's phone number and email address are secure, an assumption that fails when an attacker has already compromised those contact details or can perform a SIM swap attack.
Additionally, messaging platforms differ in how they handle account recovery. Some allow password resets without verification; others allow multiple simultaneous login sessions. Once an attacker has credentials, the messaging platform's security model may offer little resistance. This is particularly acute for platforms used by officials for classified or sensitive communications, where compromise of a single account can expose entire conversation histories and contact networks.
Defending High-Risk Accounts
For government, military, and diplomatic personnel, a few specific mitigations matter more than generic security advice. First, organisations should assume that SMS is not a secure channel for verification or account recovery. Where possible, authentication should use hardware security keys (FIDO2/U2F) rather than SMS-based one-time passwords, since hardware keys resist phishing entirely. SMS-based 2FA is better than no 2FA, but substantially weaker than hardware-backed authentication.
Second, account recovery mechanisms should require human verification—not just automated SMS resets. If a user requests a password reset, an alternative contact channel (a secure phone call, or a pre-registered trusted contact) should be used to confirm the request. This adds friction, but substantially reduces the window of opportunity for attackers who have stolen credentials but lack deeper access to the target's communications.
Third, organisations should educate high-value targets that SMS messages requesting authentication are a common attack vector. This is particularly important for officials who move between devices or travel frequently, as these scenarios create natural points where they might attempt to re-authenticate and be more receptive to fake prompts. Training should distinguish between official notifications (which often lack urgency language) and social engineering (which typically emphasises time pressure).
The Broader Implication
This campaign illustrates that large-scale credential theft can succeed without sophisticated technical exploits. Patient reconnaissance, basic social engineering, and willingness to conduct operations across many targets can yield sustained access to sensitive accounts. For organisations hosting or supporting high-risk users—whether government, activism, or journalism—the security model must assume that phone numbers and email addresses are compromised, and that authentication mechanisms relying solely on those channels will fail.
The lesson extends beyond messaging platforms. Any service that uses SMS or email as a recovery channel, without additional verification, is vulnerable to the same pattern. Defending against this requires both organisational discipline and willingness to inconvenience users with stronger authentication mechanisms.
