Russian hackers targeting journalists and officials on Signal and WhatsApp, Dutch agencies warns

Campaign relies on phishing and social engineering techniques rather than technical vulnerabilities in the apps

Russian state-backed hackers are targeting users of encrypted messaging platforms Signal and WhatsApp in a global cyber campaign aimed at government officials, military personnel and journalists, Dutch intelligence agencies have warned.

The Netherlands' Defence Intelligence and Security Service (MIVD) and the General Intelligence and Security Service (AIVD) said on Monday that they had uncovered a "large-scale global" effort by Russian actors to gain access to accounts on the two widely used messaging applications.

According to the agencies, the campaign relies on phishing and social engineering techniques rather than technical vulnerabilities in the apps themselves.

The attackers are attempting to trick users into sharing their security verification or PIN codes, which can then be used to take control of their accounts.

One of the most common tactics involves hackers posing as a Signal Support chatbot. Victims are persuaded to provide authentication codes, allowing the attackers to link the victim's account to their own devices.

Another method exploits the "linked devices" feature available in both Signal and WhatsApp, enabling hackers to synchronise a compromised account with additional devices without the owner's knowledge.

Once access has been obtained, the attackers can read incoming messages, including those sent within group chats.

Dutch officials believe the campaign may already have exposed sensitive communications.

Signal and WhatsApp both use the Signal Protocol, a widely respected end-to-end encryption system designed to protect message content during transmission. However, encryption does not prevent attackers from reading messages if they gain control of a user's device or account.

Trusted platforms become targets

The MIVD said Russia's interest in Signal was likely linked to the platform's strong reputation for secure communications.

"Despite their end-to-end encryption option, messaging apps such as Signal and WhatsApp should not be used as channels for classified, confidential or sensitive information," said MIVD director Vice-Admiral Peter Reesink.

AIVD director-general Simone Smit noted that the messaging services themselves had not been compromised.

"It is not the case that Signal or WhatsApp as a whole have been compromised," she said. "Individual user accounts are being targeted."

Dutch intelligence agencies have published a cyber advisory outlining steps users can take to detect suspicious activity.

Among the warning signs are duplicate identities appearing in group chats, which may indicate that an account has been taken over or replaced by a malicious actor.

Officials also urged users to be cautious of unfamiliar participants in chat groups.

Malicious actors may also join groups using invitation links obtained through compromised accounts. In such cases, authorities advise contacting a group administrator to remove unknown members.

A spokesperson for Meta, the parent company of WhatsApp, said users should never share their six-digit verification code with anyone.

Wider cyber campaign

The Dutch warning comes amid growing concern over Russian cyber operations targeting secure communications platforms.

Security researchers at Google warned last year that Signal's extensive use by Ukrainian soldiers, politicians and journalists had made the platform a regular target for Russian espionage operations.

In one documented incident, Russian military hackers reportedly connected Signal accounts from devices captured on the battlefield to their own systems.

In December, Amazon said a long-running operation attributed to Russia's military intelligence agency had targeted Western critical infrastructure between 2021 and 2025. The operation was attributed to Sandworm hacking group that is widely believed to act on behalf of Russia’s GRU military intelligence service.