These efforts include scripts like WAVESIGN, which periodically extracts messages from Signal’s database, and Infamous Chisel, a known Android malware variant. Other actors, such as Turla and UNC1151, have leveraged PowerShell and command-line utilities to steal stored Signal messages from compromised computers, as well.

Google's Threat Intelligence Group warned Wednesday that Russia's GRU military intelligence is hacking Signal accounts used by Ukraine's military.

Google says Russia increased its targeting of encrypted apps like Signal as Ukraine ramped up its counteroffensive.

Russian-linked cyberattackers are increasingly focused on users of the encrypted messaging app Signal, according to a new report from the Google Threat Intelligence Group.