The QR code that adds a stranger to your account

On 20 March 2026 France’s CERT‑FR published an alert called Ciblage des messageries instantanées — the targeting of instant messaging — under the reference CERTFR‑2026‑ALE‑003, updated on 18 June. It is short, and it describes two ways of taking someone’s messaging account. Neither involves a vulnerability. Neither involves malware. The first one is a QR code.

The lure is an invitation. A message suggests you join a group discussion, and to join, you scan. What the code carries is not an invitation. Google’s Threat Intelligence Group documented the mechanism in February 2025, in a report on Russia-aligned actors targeting Signal. One cluster, tracked as UNC5792, hosted copies of genuine Signal group-invite pages on its own infrastructure. The pages were identical. The single edit was in the JavaScript that runs when you accept: where the real page redirects to sgnl://signal.group/, the copy redirects to sgnl://linkdevice?uuid=…&pub_key=…. The rest of the deception is doing no work at all.

What linking grants, and what it does not

GTIG is precise about the payoff: “If successful, future messages will be delivered synchronously to both the victim and the threat actor in real-time, providing a persistent means to eavesdrop on the victim’s secure conversations without the need for full-device compromise.” Note future. This is not primarily a raid on an archive; it is tenancy. The attacker becomes one of the account’s endpoints and stays there, receiving each new message as it is sent, correctly encrypted, for as long as nobody looks. The report calls this abuse of the linked-devices feature “the most novel and widely used technique underpinning Russian-aligned attempts to compromise Signal accounts.”

The second road

The other vector in the CERT‑FR alert gets less attention and deserves more. Instead of adding a device to your account, the attacker takes the account’s number. The approach is conversational: someone makes contact, manufactures urgency, and asks for a code — the verification code, or the PIN that guards re-registration. With those, the number can be registered somewhere else. CERT‑FR describes the outcome as an irreversible seizure of the account.

A linked device is a guest you can evict. A re-registered number is a lock that was changed while you were still holding the old key.

The defence against the second road has to be in place before you need it, and it is the one piece of messenger hygiene almost nobody performs: set the app’s PIN, and never hand it, or a verification code, to anyone at all — including someone who says they are support. CERT‑FR recommends both. The reason to do it tonight is that on the day it matters, the request will not look like an attack. It will look like help.

Why nobody notices

GTIG’s most useful sentence is its least dramatic. Device linking, the report says, “has proven to be a low-signature form of initial access due to the lack of centralized, technology-driven detections and defenses that can be used to monitor for account compromise via newly linked devices.” That is a courteous way of saying the apps do not tell you. Germany’s BfV and BSI, in a joint advisory on 6 February 2026, described the same campaign shape in one clause: weder Schadsoftware eingesetzt noch technische Schwachstellen der Messengerdienste ausgenutzt werden — neither is malware deployed nor are technical weaknesses in the messaging services exploited. What is used instead is the legitimate security functions of the applications, combined with social engineering.

Every app named here already ships the countermeasure. Signal has a linked-devices list. WhatsApp has one. It is accurate, it is one tap from revoking the intruder, and it is silent — and the silence is the entire attack surface. A control that fires only when consulted protects the users who were already suspicious, which is the smallest group there is.

Ours was the same

OSHI had this gap exactly. It listed linked web sessions, it could revoke any of them, and it never told you a new one had appeared. That is fixed: on iOS it ships in 1.0.45, submitted for review on 13 September 2026, and on Android the same day. A new linked session now announces itself instead of waiting to be found.

One thing is still open, and it belongs in an article rather than in a changelog nobody opens. GET /api/web/sessions answers without a signature. Anyone who knows a user’s public address can ask our server which devices that user has linked, and be told. No message content is exposed, and nothing can be linked or revoked that way — but on a product like this, whether you run a desktop session and when it appeared is not nothing. A server-side owner gate is deployed and is running in permissive mode while unsigned traffic is measured, which means that today it records what it would refuse and refuses nothing.

The rule that survives contact

CERT‑FR’s advice compresses to five words: ne jamais scanner de QR codes reçus — never scan QR codes you receive. That sounds crude for a notice aimed at ministers and journalists, and it is exactly right, because this failure has no visual tell. A malicious pairing code and a legitimate one are both a square of noise. There is nothing in them to inspect and no way to hover over them. The only signal available is provenance, and the only provenance worth anything is your own: real pairing starts with you, inside the app, in a menu you deliberately opened. Everything else is a request to add a stranger to your account, made by the stranger.