Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Michał "rysiek" Woźniak · 🇺🇦 (rysiek@mstdn.social)'s status on Wednesday, 19-Feb-2025 22:30:11 JST Michał "rysiek" Woźniak · 🇺🇦

   in reply to

   Technical details in the report:
   https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger

   The tl;dr is:

   Signal uses https://signal[.]group/#hash-fragment links in QR codes that allow people to join groups. Group identifier is in the hash-fragment.

   The link loads in a browser first. A bit of JS redirects it to a sgnl://signal[.]group/hash-fragment link that is then handled directly by Signal app on mobile.

   Malicious QR codes use a different domain (list in the report) and redirect to a sgnl://linkdevice URL instead.