Threat Actors Abuse Messaging Platforms to Launch Phishing Attacks

Messaging platforms are now a major vector for phishing and other social engineering attacks, according to a new report from NCC Group’s Fox-IT.

The researchers warn that legitimate messaging apps such as WhatsApp, Telegram, Discord, Signal, LinkedIn, and Gmail-integrated messaging serve as avenues through which attackers can target users while evading email security filters.

“Messaging platforms are being leveraged as attack vectors by serving as initial access points, delivery channels, and coordination infrastructure within modern attack chains,” the researchers write.

“Threat actors have used these to deliver phishing links, malicious attachments, QR codes, and fake invitations that exploit legitimate platform features. Even encrypted messaging services are being used to distribute mobile malware and spyware, either through direct user interaction (such as opening files or links) or through feature abuse that enables silent account access.

“In parallel, platforms such as Telegram are being utilised to host phishing infrastructure, malware repositories, stolen data, and automated bot-based services that support large-scale fraud and intrusion campaigns.”

The researchers predict that these attacks will increase as more users adopt these technologies.

“The use of messaging platforms as an attack vector is expected to increase further as these services continue to expand in functionality and integrate with other digital ecosystems,” Fox-IT says. “Some messaging apps are increasingly converging with payments, cloud storage, authentication, and enterprise services. This creates new opportunities for abuse beyond simple message delivery.

“At the same time, attackers are refining their techniques that exploit platform-specific features and user behaviour rather than vulnerabilities in underlying encryption. As messaging platforms replace email and SMS as the primary mode of communication in many regions and organisations, threat actors are likely to treat them as a default vector for initial access, malware delivery, and campaign coordination.”

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 HRM+ platform to strengthen their security culture and reduce human risk.

Fox-IT has the story.