Dutch Agencies Warn of Signal and WhatsApp Account-Hijacking Campaign
Summary
Dutch intelligence agencies say Russian state-sponsored actors are targeting officials, military personnel and journalists with Signal and WhatsApp phishing, using stolen verification codes or malicious device-linking QR codes to access messages.
Key points
- Dutch intelligence agencies report that government employees have been targeted, alongside officials, military personnel and journalists.
- Fake Signal support messages trick users into sharing SMS verification codes and Signal PINs, which attackers can use to take over accounts.
- Attackers may change the phone number linked to a taken-over Signal account, gaining access to contacts and incoming messages.
- Malicious QR codes or links can add an attacker-controlled device to a Signal or WhatsApp account, potentially without locking out the victim.
- Signal says the attacks use phishing and that its encryption and infrastructure have not been compromised.
- Dutch agencies advise users to avoid sharing sensitive information over messaging apps, verify invitations through trusted channels and remove unknown linked devices.
Article Details
- Event Type
- Phishing and account-hijacking campaign targeting Signal and WhatsApp users through fake support messages, requests for verification codes and PINs, and malicious device-linking QR codes or links.
- Impact
- Dutch agencies confirmed that Dutch government employees were targeted. The reported methods can let attackers take over accounts or covertly link their devices, potentially exposing contacts, incoming messages, group-chat messages, and chat history, enabling real-time monitoring or messages sent in the victim’s name. Signal said some users, including government officials and journalists, experienced account takeovers; it stated that Signal’s encryption and infrastructure were not compromised.
MITRE ATT&CK
T1098 · Account ManipulationAfter gaining account access, attackers may register the account on their device, change its associated phone number, or link their device to the victim’s account.T1566 · PhishingAttackers use phishing messages impersonating Signal support to persuade victims to provide SMS verification codes and Signal PINs.
Products
SignalRussian state-sponsored hackers are conducting a targeted Signal and WhatsApp phishing campaign against government officials, military personnel, and journalists to gain access to sensitive messages.WhatsAppRussian state-sponsored hackers are conducting a targeted Signal and WhatsApp phishing campaign against government officials, military personnel, and journalists to gain access to sensitive messages.
Countries
Industries
GovernmentRussian state-sponsored hackers are conducting a targeted Signal and WhatsApp phishing campaign against government officials, military personnel, and journalists to gain access to sensitive messages.MediaSignal posted on social media that it is aware of targeted phishing attacks that have resulted in account takeovers and warned users to remain vigilant.MilitaryRussian state-sponsored hackers are conducting a targeted Signal and WhatsApp phishing campaign against government officials, military personnel, and journalists to gain access to sensitive messages.