Dutch Agencies Uncover Russian Cyber Campaign on Signal, WhatsApp

Dutch intelligence agencies have uncovered a large-scale global cyber campaign by Russian state-linked operatives targeting encrypted messaging apps Signal and WhatsApp, with some Dutch government employees already victimized. The warning, issued jointly by the General Intelligence and Security Service (AIVD) and the Military Intelligence and Security Service (MIVD) on March 9, highlights risks to military personnel, civil servants, journalists, and other individuals of interest to Russian intelligence.

The operation relies on social engineering and phishing tactics rather than exploiting vulnerabilities in the apps themselves. Attackers frequently impersonate Signal's support chatbot, sending unsolicited in-app messages to users claiming suspicious activity on their accounts. These fake messages urge recipients to provide their SMS verification code or Signal PIN to resolve the issue, allowing hackers to register the account on their own device and gain full access to chats and contacts. Signal has emphasized that its support team never initiates contact to request such codes, stating on social media, "If anyone asks for any Signal-related code, it is a scam."