Signal and WhatsApp targeted by hackers? The Netherlands warns against the Russian campaign

The Dutch intelligence services AIVD and MIVD said on Monday that Russian hackers were conducting a large-scale campaign to take over the accounts of Signal and WhatsApp users, including government officials, military officials and journalists. Some of it was to be effectively taken over.

According to the services, the targets of the campaign were high-ranking government representatives, military and officials around the world, as well as journalists. Dutch authorities said that Dutch victims of the operation had already been informed; however, their number and identity were not revealed.

According to AIVD and MIVD, the attacks did not involve exploiting technical vulnerabilities in the applications themselves, but by manipulating users. The hackers allegedly impersonated, among others: to Signal's technical support and persuade victims to provide verification codes, PIN or scan a QR code. In this way, the attackers could take over the account or add their own device to an existing account and gain access to correspondence, including in group chats.

The services recalled that similar activities by Russian groups had been observed in the past. In 2023-2024, phishing was used using invitations to chat groups, and in 2025, a campaign was carried out encouraging Signal users to allegedly re-verify their accounts.

In February this year German intelligence also warned against a similar campaign. At that time, he reported on attacks targeting politicians, military personnel, diplomats and investigative journalists in Germany and other European countries.

Dutch services recommended not to share confidential or secret information via instant messengers, regularly check the list of connected devices, ignore unsolicited group invitations and consider using the disappearing message function.

Patryk Kulpok from The Hague (PAP)

pmk/ piu/