I don't see it mentioned in the article (though I might have missed it), but: > As such, the cybercriminals managed to pull off the attack by impersonating the

I don't see it mentioned in the article (though I might have missed it), but: > As such, the cybercriminals managed to pull off the attack by impersonating the victim of the attack for roughly 13 hours. All the contacts of that victim would have received a warning that the victim had changed their encryption keys (WhatsApp has that warning too, but unlike Signal it's disabled by default), and IIRC, that warning shows up before you try to send a message. Even if they're not the kind of people who checks whether the encryption keys match (it's very easy to do if you're meeting in person, but not many people do), that warning can be enough to alert the contact that something odd is going on.