Context: How Fake Support Texts Became a Weapon

According to a report by The Hacker News, Ukrainian authorities working with the FBI uncovered a campaign where attackers sent fake SMS messages pretending to be from messaging app support teams. The goal was to trick government officials, military personnel, and activists into handing over their account credentials. The attackers specifically targeted users of apps like Signal and WhatsApp, aiming to steal sensitive information from high-value individuals in Ukraine, Europe, and the United States.

This matters because it shows how sophisticated state-backed groups are using simple tricks to break into secure accounts. Instead of hacking the apps themselves, they go after the weakest link — the people using them. The fact that the campaign ran for a long time without being widely noticed highlights how effective these fake support messages can be.

Why This Attack Method Is So Dangerous

These fake texts exploit trust. When a message looks like it comes from an official support bot, many users will click and follow instructions without a second thought. The attackers ask for login codes, recovery keys, or passwords, which are exactly what someone needs to take over an account. Once inside, they can read private messages, access files, and even impersonate the victim.

This method bypasses most technical defenses like firewalls and antivirus software because the user voluntarily gives up their credentials. The same technique could easily be reused by criminal groups against businesses, not just government targets. It’s a reminder that security relies on both technology and human awareness.

What This Means for Australian SMBs

Australian small and mid-sized businesses might think they are too small to be a target, but attackers often cast a wide net. Phishing campaigns similar to this one — using fake support texts for messaging apps — are easy to copy and cheap to run. If your employees use WhatsApp, Signal, or similar tools for work communication, they could receive a fake message pretending to be from the platform.

Losing access to a business messaging account can lead to data breaches, stolen customer information, or even financial fraud. For an SMB, that kind of hit can be devastating. Being aware of these tactics and training staff to spot them is just as important as having the right software in place.

What You Can Do Now

  • Turn on two-factor authentication (2FA) for every messaging app your business uses. This adds an extra step that stops attackers even if they steal your password.
  • Never share account recovery codes, PINs, or passwords in response to a text or email. Legitimate support teams will never ask for them.
  • If you receive a message from "support," do not click any links. Instead, open the app’s official website or settings to verify the request.
  • Regularly review the list of active sessions in your messaging apps and log out any devices you don’t recognize.
  • Train your team to be suspicious of unexpected messages asking for login details. Run a short, simple drill to test their awareness.

Staying safe from these attacks doesn’t require a big budget — just good habits and a little caution. At MS&VG, we help Australian SMBs build practical cybersecurity practices that protect against threats like credential theft and phishing. If you’d like guidance tailored to your business, reach out to our team.