Russian Social-Engineering Campaign Targeting Signal and WhatsApp Accounts

The Dutch intelligence and military security services (AIVD and MIVD) warned of a large-scale Russian cyber campaign targeting individual Signal and WhatsApp accounts—particularly those of government officials, journalists, and military personnel—by persuading victims to disclose security verification codes and PINs. The activity does not involve breaking end-to-end encryption or exploiting a technical vulnerability in the apps; instead, it abuses legitimate account and security workflows. One commonly observed tactic is impersonation of a Signal Support chatbot to solicit verification information, enabling account takeover and access to messages and group chats.

The agencies also reported abuse of the apps’ “linked devices” functionality, where attackers attempt to attach an additional device to a victim’s account to mirror messages in real time. AIVD/MIVD assessed that the campaign has already produced victims, including within the Dutch government, and that attackers likely accessed sensitive information as a result. Separate reporting about a fake Red Alert Android app used to spy on Israeli users describes a different mobile-malware operation (SMS lure, sideloaded trojanized app, extensive permissions, and data exfiltration) and is not part of the Signal/WhatsApp account-takeover campaign.