Russian state hackers are trying to break into Signal and WhatsApp accounts used by diplomats, military staff, and government officials worldwide, Dutch intelligence agencies warned. They believe journalists and other people who attract attention from Moscow may also be affected.
Investigators reported attackers attempt to trick users into revealing verification codes and PINs that protect their messaging accounts.
The agencies said the Russian campaign does not exploit technical vulnerabilities in the messaging services. Instead, the attackers misuse legitimate security features of the apps.
“It is not the case that Signal or WhatsApp as a whole have been compromised. Individual user accounts are being targeted.” stated Director-General of the AIVD Simone Smit.
According to the agencies, hackers used two methods. One involves posing as a Signal support chatbot to trick targets into sharing login credentials. The other exploits the linked devices feature in Signal and WhatsApp, which allows additional devices to connect to an account.
Once the code is shared, attackers can read private conversations and group chats.
Users likely assumed that the reputation of apps like Signal would shield them from hacking attempts, a belief Russian hackers seem to have deliberately leveraged.
“Chat applications like Signal and WhatsApp, despite having end-to-end encryption, are not channels for classified, confidential, or sensitive information,” emphasizes Vice Admiral Peter Reesink, Director of the MIVD.
Officials advise users to watch for duplicate identities in group chats, as this can signal a compromised account. If the same person appears twice under identical or slightly different names, it may indicate an account takeover or a replacement profile. To support those affected, a cybersecurity advisory has been released.
