The guides below are drafts: a lawyer has not reviewed them yet. This is not legal advice.
Draft What human rights defenders advise
My account was hacked or I suspect surveillance
Another device first. Act from a device you trust, not the one that may have been hacked or seized. In Telegram, WhatsApp, Google and Apple, open the list of active sessions and end any you don't recognise. Change your password and turn on two-step verification; in Telegram this is the cloud password. Check your email for an unfamiliar recovery address or forwarding rules. SMS codes can be intercepted, including by security services, so a cloud password or an authenticator app is more reliable.
Warn family and colleagues through another channel: they should not trust messages in your name, open links or send money. Hijacked accounts are used to write to your contacts and lure out their data. If your chats held information about other people, think about whom to warn separately.
Phishing 'from Telegram'. From October 2024 to July 2026, users in Russia, Belarus and Kazakhstan received fake 'Telegram security warnings'. A message arrived in a secret chat from an unknown account: there were many complaints about you, and the account would be blocked unless you confirmed it via a link. The link led to a fake login page asking for your code. RESIDENT.NGO advises not entering a login code or cloud password on a page opened from a link, and turning on the cloud password in advance. If you have already entered a code, take the first step straight away.
Your phone was taken. If your phone was taken during a detention, search, questioning or at the border, assume it may carry spyware. In December 2024 Citizen Lab and First Department (a 'foreign agent') described Monokle-like spyware on a phone returned to programmer Kirill Parubets after his detention. In December 2025 RSF ('undesirable' in Russia) found ResidentBat spyware on a Belarusian journalist's phone after KGB questioning: officers had watched the unlock code being entered. Such programs read messages, record conversations and track location. Use another device for anything important and have this phone checked by specialists.
What not to do. By law a phone can be seized only with a written record; in practice it may be returned with spyware installed. Don't remotely wipe a seized device or delete accounts before talking to a lawyer: if there is a case, this can be used against you, and your messages remain with the other people and in the cloud anyway. Decide with your lawyer what to do with the accounts on a seized phone.
Who can help. The Access Now Digital Security Helpline works around the clock, for free and in Russian: it helps activists, journalists and human rights defenders recover accounts and check devices. The RSF Digital Security Lab helps journalists (RSF is 'undesirable' in Russia). RESIDENT.NGO helps NGOs and activists from Eastern Europe. If you suspect surveillance after a detention, you can contact First Department (a 'foreign agent'). First Line explains in detail how to set up Telegram and two-step verification.
Designations of organisations in this guide: Reporters Without Borders (RSF) (undesirable); RSF Digital Security Lab (undesirable). Contacting them carries a risk: do not write from a phone that may be seized, and do not repost their materials.
Free, anonymous psychological support for people affected by, or afraid of, political persecution and for their families; an information line and safety guides.
The only official bot is @FirstLineHelpBot. It never asks for money or SMS codes.
Digital security specialists for NGOs, human rights defenders, media outlets and activists: investigating hacks and phishing, malware analysis, checks of devices and accounts, help with DDoS attacks.
Has worked for more than ten years in Belarus, Moldova, Ukraine and other Eastern European countries. In July 2026 it documented phishing disguised as Telegram warnings against users in Russia, Belarus and Kazakhstan, and in December 2025, together with RSF, it found the ResidentBat spyware. The website lists email as the only contact.
Free forensic help for journalists: checking devices for spyware, analysing phishing and account takeovers.
Helps journalists and media workers only. Priority goes to cases with clear signs of an attack: a device seized by police, a password entered on a phishing page, a hijacked account. If no spyware is found, that does not prove there is none. RSF has been designated 'undesirable' in Russia since 2025: if you are a Russian citizen or travel there, factor in the risk.