Russian hackers target Signal, WhatsApp in global cyber campaign
Russian hackers launched a global cyber campaign targeting WhatsApp and Signal accounts, Dutch intelligence agencies said March 9.
"Russian state hackers are engaged in a large-scale global cyber campaign to gain access to Signal and WhatsApp accounts belonging to dignitaries, military personnel and civil servants," the Netherlands' General Intelligence and Security Service (AIVD) said in a statement.
Dutch intelligence agencies said the campaign targeted government employees and may also be aimed at other persons of interest to the Russian government, including journalists.
The attackers reportedly used phishing tactics to persuade users in chats to disclose security verification codes and passcodes, allowing them to access personal accounts and group chats.
"The Russian hackers have likely gained access to sensitive information," AIVD and the Dutch Military Intelligence and Security Service (MIVD) said in a joint statement.
Signal acknowledged the reports in a social media post, saying it was aware of targeted phishing attacks that have led to some account takeovers.
"We are aware of recent reports regarding targeted phishing attacks that have resulted in account takeovers of some Signal users, including government officials and journalists," the company said. "We take this very seriously."
Signal emphasized that its encryption systems were not compromised.
"To be clear: Signal's encryption and infrastructure have not been compromised and remain robust," the company said, adding that the attacks relied on "sophisticated phishing campaigns designed to trick users into sharing information."
Dutch intelligence officials also said the campaign did not exploit technical vulnerabilities in the messaging apps themselves.
"The Russian campaign does not exploit any technical vulnerabilities of the messaging services,' the agencies said. "Instead, the attackers make malicious use of legitimate security features of the apps."
Russian-linked hacking groups have conducted cyber operations for decades, often focusing on financially motivated attacks such as ransomware.
Since Russia's full-scale invasion of Ukraine, however, the country's cyber activities have increasingly shifted toward more disruptive and destructive operations targeting Ukraine's Western allies.
Cyberattacks have become a central element of Russia's hybrid warfare strategy. European governments have repeatedly accused Moscow of escalating cyber operations, including attacks on Ukrainian systems, breaches of civilian infrastructure in Europe, and attempts to interfere in foreign elections.
