Loading story…
Belgian authorities, including the Public Prosecutor’s Office and the Centre for Cybersecurity Belgium (CCB), warned that unknown actors have been impersonating His Majesty the King and other senior figures (including the King’s chief of cabinet and the head of Belgium’s military intelligence service) to fraudulently solicit money from targeted victims. Since early 2025, foreign dignitaries, Belgian families, and business leaders have been contacted via phone, WhatsApp, and email using spoofing-style techniques to make messages appear to originate from the Royal Palace or the King Baudouin Foundation; early lures included requests for funds tied to a fabricated story about “liberating” Belgian journalists allegedly held hostage in Syria, with at least one reported transfer.
Authorities reported a renewed wave of attempts in early January 2026 focused largely on Belgian business leaders, including invitations to video calls intended to increase credibility; the video imagery may have been AI-generated. Some targets also received fake invitations to sponsor a non-existent gala dinner purportedly organized by the King Baudouin Foundation (claimed to be scheduled for February and April 2026). The Federal Prosecutor’s Office is conducting a preliminary investigation with the Federal Computer Crime Unit (FCCU) and other federal police services, and CCB continues broader national efforts to strengthen cybersecurity across critical sectors, though no additional investigative details were released.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
The Federal Prosecutor’s Office, supported by the Federal Computer Crime Unit and other specialized federal police services, began a preliminary investigation into the scam campaign. On January 24, 2026, the Public Prosecutor’s Office and the Centre for Cybersecurity Belgium publicly warned about the fraud and said further details were being withheld to protect the case.
Some victims received invitations to a non-existent King Baudouin Foundation gala dinner supposedly scheduled for February and April 2026. The invitations were part of the broader impersonation scam exploiting royal and public-figure identities.
In early January 2026, authorities detected a renewed wave of scam attempts focused mainly on Belgian business leaders. The operation included invitations to video calls meant to convince victims they were speaking with the King, with authorities assessing the imagery may have been AI-generated.
As part of the scam campaign, the perpetrators asked targets for funds tied to a fabricated hostage situation involving Belgian journalists allegedly held in Syria. Most targets identified the approach as fraudulent, but at least one victim transferred money.
Since early 2025, unknown perpetrators have contacted foreign dignitaries, Belgian families, and business leaders by phone, WhatsApp, and email while posing as His Majesty the King and other senior Belgian figures. The messages used spoofing-style techniques to appear as though they came from the Royal Palace or the King Baudouin Foundation.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Germany’s **Federal Office for the Protection of the Constitution (BfV)** and **Federal Office for Information Security (BSI)** warned of suspected **state-linked phishing** operations targeting high-ranking individuals—politicians, military officers, diplomats, and investigative journalists—across Germany and Europe via messaging apps, notably **Signal**. The advisory emphasizes the campaign relies on **social engineering**, not malware or exploitation of technical vulnerabilities, with attackers contacting targets directly inside the app while impersonating *Signal* support personnel or a “security chatbot.” Authorities described two primary tactics to gain covert access to victims’ communications and networks: (1) **full account takeover** by tricking targets into sharing their Signal **PIN** or **SMS/one-time verification code**, enabling attackers to register the account on an attacker-controlled device and lock out the victim; and (2) **silent monitoring** by persuading targets to scan a **QR code** that abuses Signal’s legitimate `linked devices` feature to pair an attacker-controlled device, allowing ongoing access to one-to-one and group chats and contact lists. The agencies noted that while the activity is assessed as likely state-backed, the same methods could be replicated by non-state or financially motivated actors.
Jun 29, 2026
The FBI's Internet Crime Complaint Center (**IC3**) has warned that scammers are posing as FBI personnel and IC3 representatives to target people who have already lost money to cybercrime and fraud. The operation uses fake social media profiles, direct messages, phone calls, emails, online forums, spoofed IC3 websites, and **AI-generated videos** of senior FBI officials to falsely claim that stolen funds have been recovered or can be recovered, with the goal of stealing additional personal and financial information. The FBI said the fraudsters often contact victims on platforms such as Facebook Messenger before moving conversations to apps like Telegram, where they may send links that harvest data or contain malicious code. Deepfake videos have also been used to steer victims to fake complaint portals designed to mimic `ic3.gov` and collect sensitive details about prior losses. IC3 stressed that it has **no social media presence**, does not initiate contact through social media, chat apps, phone, or email to recover money, and never asks victims to pay fees for fund recovery; legitimate follow-up would come from an FBI employee or another law enforcement official.
Aug 11, 2026
A **social-engineering campaign targeting Signal and WhatsApp accounts** has hit prominent German officials and security figures, including former BND vice president **Arndt Freytag von Loringhoven**. Attackers reportedly impersonated **Signal support** and tricked victims into disclosing their PINs, enabling account compromise and follow-on abuse. In Freytag von Loringhoven’s case, the hijacked account was then used to send a malicious link to his contacts before he warned them and deleted the account. German authorities had already classified the activity as **security-relevant** and advised potential victims to check for signs such as unknown linked devices and unexpected re-registration prompts. The campaign appears to be part of a broader **espionage-focused operation** affecting politicians and officials in Germany, with investigators reportedly suspecting a connection to **Russian hybrid activity**. One additional report references the same incident only in passing while discussing a separate German cybersecurity legislative proposal, reinforcing that the compromise of the former intelligence official was one of several recent security incidents shaping the policy debate. A separate article on Frankfurt police use of a mobile facial-recognition app is **not related** to the account-takeover campaign and should be excluded.
Jun 29, 2026