New FBI Alert: Russian Intelligence Uses Signal Recovery Keys to Access Messages
2026-06-28T08:51:42Z•8a10bbc18cbada2d8c5f9797b168068d7872ccad2d066c571809e9c871861033
APTTonRATaccount-takeoverdata-breachespionagelinux-kernelmacOS-malwarephishingprivilege-escalationsignalsupply-chainvulnerability-management
What happened
Consolidated security roundup: FBI/CISA warn Russian intelligence actors are harvesting Signal backup/recovery keys to access message histories and perform long-term account takeovers. Microsoft reports a hospitality-targeted phishing campaign delivering TonRAT with resilient persistence. JFrog disclosed DirtyClone (CVE-2026-43503), a Linux kernel privilege-escalation that rewrites executables in memory (CVSS ~8.8) — exploit demonstrated; apply kernel patches immediately. Palo Alto Unit 42 attributes sustained operations by Chinese-speaking APT CL-STA-1062 against Southeast Asian government/能源
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 8a10bbc18cbada2d8c5f9797b168068d7872ccad2d066c571809e9c871861033
- Enrichment time
- 2026-06-28T08:51:42Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.