One scanned QR code can quietly add an attacker's computer to a victim's end-to-end encrypted messaging account, and every new message then arrives on both devices. MITRE ATT&CK for Mobile T1676 Linked Devices (tactics TA0035 Collection and TA0028 Persistence, platforms Android and iOS) covers adversaries who abuse the linked devices feature of messaging apps, with Signal and WhatsApp as ATT&CK's examples, to register the victim's account on a device they control. No exploit and no malware on the phone are needed, which is why it suits espionage against officials, researchers and military staff. This guide explains how the abuse works, what the documented campaigns show, which telemetry can reveal it, and the controls and user habits that stop it. It is written for security teams protecting high-risk users and anyone responsible for messaging app policy. Apps are listed alphabetically.
Key takeaways
- The feature works as designed. Linking lets a user reach their account from a desktop or tablet; the attack is getting the victim to link the attacker's device, usually through a QR code disguised as a group invite, a security alert or pairing instructions.
- Persistence without device compromise. Google Threat Intelligence Group (GTIG) describes the linked device as giving real-time access to future messages, and calls it low-signature because few technical controls monitor newly linked devices.
- State actors use it. ATT&CK records Sandworm Team (G0034) linking Signal accounts on battlefield-captured devices to its infrastructure, and Star Blizzard (G1033) linking WhatsApp accounts to its infrastructure or WhatsApp Web to exfiltrate messages.
- The linked devices list is the control. Both apps show linked devices in their settings; reviewing and removing unknown entries is the single most effective response, and GTIG recommends doing it regularly.
- Detection is thin, so prevention and habits matter. ATT&CK's v20 analytics rely on app vetting, network and proxy data; for most organisations the strongest controls are QR code awareness, managed app updates, and hardened modes for at-risk users.
How the abuse works
ATT&CK describes the sequence. The adversary uses phishing (T1660) to get the user to scan a QR code that links the user's account to an adversary-controlled device. ATT&CK lists masquerades as group invites, security alerts or legitimate pairing instructions. Once linked, the adversary can collect messages and the contacts list, and can send messages from the linked device. ATT&CK also notes that history can be synchronised during linking, which may give the adversary earlier messages as well as new ones; check each app's current documentation for how history transfer behaves today, because it has changed over time.
The phone itself remains uncompromised. Mobile threat defense on the device sees no malware, the operating system sees a normal app action and the encryption is intact. The weakness is the account's set of trusted devices.
| Lure | Documented example | Source |
|---|---|---|
| Fake group invite | UNC5792 altered legitimate-looking Signal group invite pages so the redirect linked the victim's account instead of joining a group, hosted on lookalike domains | GTIG, February 2025 |
| Fake app or security alert | UNC4221 used a phishing kit mimicking Kropyva, an artillery guidance app used by Ukraine's armed forces, with fake device-linking instructions, embedded QR codes and, in 2022, fake Signal security alerts | GTIG, February 2025 |
| Close access | APT44 (Sandworm) linked Signal accounts on devices captured on the battlefield to its own infrastructure | GTIG, February 2025; ATT&CK G0034 |
| Email to a group invite | Star Blizzard impersonated a US government official, sent a deliberately broken QR code to prompt a reply, then a link to a page whose QR code linked the target's WhatsApp account to a linked device or WhatsApp Web; observed mid to late November 2024 | Microsoft Threat Intelligence, January 2025; ATT&CK G1033 |
Related Mobile collection pages: T1636 Protected User Data and T1517 Access Notifications. For QR code lures in general, see the QR Code Phishing (Quishing) Guide.
The apps in ATT&CK's description
- Signal: uses the open-source Signal Protocol for end-to-end encryption. Signal's support page lists linked devices under Signal Settings, Linked devices, on the phone. GTIG reports that Signal's Android and iOS releases include hardened features against these phishing campaigns, and advises updating to the latest version.
- WhatsApp: provides end-to-end encryption and a linked devices feature for desktop, web and tablet access. Microsoft's report shows linking to WhatsApp Web as well as to a separate device, so a review should cover browser sessions too. The linked devices screen in WhatsApp settings lists active sessions and lets the user log them out.
The same approach can apply to any messaging service that pairs devices by QR code; GTIG says it expects the tactics to spread to other apps and named WhatsApp and Telegram as targets of similar techniques. See Securing Messaging Apps Guide.
Android and iOS
ATT&CK lists both platforms. The abuse is identical on each because it happens in the messaging app and its service, not in the operating system. The differences are in what an enterprise can observe and enforce.
| Control or signal | Android | iOS |
|---|---|---|
| ATT&CK v20 detection data | App vetting or dynamic analysis showing the camera activated inside a messaging app; Android Enterprise network logging (DnsEvent, ConnectEvent) or VPN flow data; proxy or secure web gateway metadata | Network Extension, per-app VPN or secure web gateway flow data; proxy metadata; app vetting of entitlements and Info.plist privacy usage keys |
| ATT&CK user guidance (M1011) | Enable Google Play Protect | Users who may be targeted should consider Lockdown Mode |
| Keep the app current | Managed Google Play automatic updates for work apps | Managed app updates through MDM |
| Device lock (GTIG advice, given against close-access attacks) | Long alphanumeric password rather than a PIN or pattern | Long alphanumeric passcode rather than a short numeric code |
Lockdown Mode is relevant here because Apple states it makes links and link previews unavailable in Messages; it does not change how a third-party messaging app links devices, so the linked devices review is still needed. See the Apple Lockdown Mode Guide and Android Advanced Protection.
Detection and measurement
ATT&CK's analytics alert on a sequence or state change inconsistent with the device or app baseline, approved policy or expected workflow, and warn against inferring unobserved content. In practice:
- Network and proxy data: watch for visits to lookalike invite or pairing domains from managed devices and browsers, and block newly registered domains that mimic messaging app invite or linking pages. Feed the indicators from GTIG and Microsoft reporting into the secure web gateway.
- Email and messaging security: flag inbound messages that carry QR codes or short links presented as group invites from officials, especially after an initial message that "failed".
- Account-side review: the most reliable evidence is the linked devices list itself. For high-risk users, schedule a review with the security team, and record the expected devices.
- Behavioural signs: contacts receiving messages the user did not send, or a linked device name the user does not recognise.
Metrics:
- Percentage of high-risk users who completed a linked devices review in the last 30 days.
- Count of unknown linked devices found and removed per quarter.
- Percentage of managed devices running the current or previous release of approved messaging apps.
- Click or scan rate in QR code phishing simulations, and the report rate.
- Count of blocked visits to lookalike invite or pairing domains.
Prevention and response
- Set a policy: state which messaging apps are approved for which information, and that pairing a new device is only done by the user from the app's own settings, never from a link or a QR code received in a message.
- Train with the real lures: group invites from officials, security alerts and pairing instructions. Microsoft recommends QR code payloads in phishing simulations.
- Keep apps and OS current: enforce automatic updates for messaging apps through the managed store so platform hardening reaches users quickly.
- Protect high-risk users: strong device passcodes, Lockdown Mode or Android Advanced Protection, two-step verification or registration lock where the app offers it, and regular linked devices reviews. See the Mobile Communications Protection for High-Risk Individuals Guide.
- Respond to a finding: remove the unknown linked device or web session, record its name and link time first, check for messages sent by the attacker, warn contacts in sensitive groups, and treat the conversations since linking as exposed.
- Consider device seizure risk: for staff in conflict zones, GTIG's APT44 example shows that a captured unlocked device can be linked; plan for remote unlinking from a second trusted device and for rapid account recovery.
Common failure patterns
- Looking only for malware: the phone is clean, so MTD and forensic checks that find nothing can give false reassurance.
- Ignoring web sessions: Star Blizzard's chain linked WhatsApp Web; reviews that only look for phones or tablets miss browser sessions.
- Trusting the sender: lures impersonated government officials and military tools; verification through a known channel is the defence Microsoft recommends.
- No review cadence: GTIG notes compromises can go unnoticed for long periods because few controls watch newly linked devices.
- Using personal messaging for sensitive work without policy: if the organisation has no approved channel or rules, it cannot set or check any of the controls above.
Where identity fits
A linked device is a second identity credential for the account: a device key the service trusts as the user. Treat linked devices like registered authenticators or OAuth grants, with an owner, a reason and a periodic review. The same pattern, a user approving a code that hands a session to an attacker, appears in device code phishing against cloud identity providers; see the Phishing-Resistant MFA Guide.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| ATT&CK for Mobile | T1676, tactics TA0035 and TA0028; mitigation M1011 User Guidance | The technique and its listed mitigation |
| ATT&CK for Mobile | T1660 Phishing | The usual delivery of the QR code |
| NIST SP 800-53 Rev 5 | AT-2, AC-19, IA-3, SI-4, IR-4 | Awareness training, mobile access control, device identification, monitoring, incident handling |
| NIST CSF 2.0 | PR.AT-01, PR.AA-05, DE.CM-09 | Awareness, managed access permissions, monitoring |
Practitioner checklist
- Approved messaging apps and their permitted uses are written down.
- Users know that devices are linked only from the app's own settings, never from a received QR code or link.
- High-risk users review linked devices and web sessions at least monthly, with expected devices recorded.
- Messaging apps update automatically on managed devices.
- Lookalike invite and pairing domains from threat reporting are blocked at the web gateway.
- Phishing simulations include QR code group invites and fake security alerts.
- High-risk users use strong passcodes and Lockdown Mode or Android Advanced Protection.
- The response runbook covers unlinking, recording evidence and warning contacts.
Standards and references
- MITRE ATT&CK: Mobile T1676 Linked Devices
- Google Threat Intelligence Group: Russia-aligned threat actors targeting Signal Messenger
- Microsoft Threat Intelligence: New Star Blizzard spear-phishing campaign targets WhatsApp accounts
- Signal Support: Linked Devices
- Apple: About Lockdown Mode
- Google: Use Google Play Protect to help keep your apps safe
Related NHI Mgmt Group resources: MITRE ATT&CK for Mobile Guide, End-to-End Encryption and Messaging Protocols Guide, Commercial Spyware Guide, Secure Enterprise Messaging.