Embed Notice

Technical details in the report:
https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger

The tl;dr is:

Signal uses https://signal[.]group/#hash-fragment links in QR codes that allow people to join groups. Group identifier is in the hash-fragment.

The link loads in a browser first. A bit of JS redirects it to a sgnl://signal[.]group/hash-fragment link that is then handled directly by Signal app on mobile.

Malicious QR codes use a different domain (list in the report) and redirect to a sgnl://linkdevice URL instead.