UNC4221 / UAC-0185 (Russia-aligned) has been silently reading Telegram, WhatsApp, and Signal messages via fake device-linking QR codes since 2022. Confirmed active June 2026.
Attack chain: phishing message → fake device-link page → attacker's device linked → silent real-time message copy. No alerts, no notifications.
IOC set from CERT-UA#12414 (32 indicators) ingested in RelayShield TI corpus.
Check your linked devices now. Full breakdown: [https://hashnode.com/edit/cmr0ystn900010ajghg2v55pt]
#OPSEC #Telegram #InfoSec #UAC0185 #ThreatIntel
