Russian cybercrims phish their way into officials' Signal and WhatsApp accounts
- Reference: 1773060053
- News link: https://www.theregister.co.uk/2026/03/09/dutch_spies_say_russian_cybercrims/
- Source link:
That's the warning issued Monday [1]by the Netherlands' intelligence and military security agencies , the AIVD and MIVD, which say a "large-scale" Russian cyber campaign is actively targeting Signal and WhatsApp accounts. The goal isn't to defeat the apps' end-to-end encryption, but to take over the accounts themselves and quietly read whatever conversations are inside.
According to the agencies, the attackers approach targets directly via chats and persuade them to share security verification codes or PINs, effectively giving the intruders full access to the account. In some cases, the attackers reportedly impersonate a Signal support bot to make the request look legitimate. Once the code is shared, attackers can log in and read messages or monitor group chats without needing to defeat the underlying encryption.
[2]
Another trick involves abusing Signal's "linked devices" feature, which allows users to connect additional devices to their account. If an attacker manages to link their own device, they can effectively mirror the victim's messages in real time.
[3]
[4]
The Dutch agencies say that the campaign has already snared victims, including people working inside the Dutch government. "The Russian hackers have likely gained access to sensitive information," the AIVD and MIVD said, adding that "targets and victims of the campaign include Dutch government employees" as well as journalists.
Ironically, the very reason officials and reporters often favor these apps – their strong encryption – also makes them a juicy intelligence target once an account itself is compromised. End-to-end encryption protects messages in transit, but it does little if an attacker manages to log into the account itself.
[5]
A Meta spokesperson told The Register that users should never share their six-digit code with others and that it provides detailed advice on how WhatsApp users can protect themselves from scams.
Signal did not immediately respond to The Register 's questions.
[6]Poland bans camera-packing cars made in China from military bases
[7]Infosec exec sold eight zero-day exploit kits to Russia, says DoJ
[8]Don't underestimate pro-Russia hacktivists, warns UK's cyber crew
[9]Russia-linked APT28 attackers already abusing new Microsoft Office zero-day
Dutch authorities released a [10]cybersecurity advisory and are assisting affected users in securing their accounts. They also warned that subtle clues can indicate a compromise, such as contacts suddenly appearing twice in a list or numbers unexpectedly showing up as "deleted account."
The bigger message from the spooks is that encrypted consumer messaging apps might be convenient, but they're not exactly a classified communications system. As MIVD director Vice-Admiral Peter Reesink put it:
"Despite their end-to-end encryption option, messaging apps such as Signal and WhatsApp should not be used as channels for classified, confidential or sensitive information."
[11]
In other words, if your operational security plan relies on the hope that nobody will ever ask you for a six-digit code in a chat, it might be time for a rethink. ®
Get our [12]Tech Resources
[1] https://english.aivd.nl/latest/news/2026/03/09/russia-targets-signal-and-whatsapp-accounts-in-cyber-campaign
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aa78tuTHFvNLk1ml-VDtiQAAAQk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aa78tuTHFvNLk1ml-VDtiQAAAQk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aa78tuTHFvNLk1ml-VDtiQAAAQk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aa78tuTHFvNLk1ml-VDtiQAAAQk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2026/02/19/poland_china_car_ban/
[7] https://www.theregister.com/2026/02/15/exl3harris_exec_sold_8_zeroday/
[8] https://www.theregister.com/2026/01/19/dont_underestimate_prorussia_hacktivists_warns/
[9] https://www.theregister.com/2026/02/02/russialinked_apt28_microsoft_office_bug/
[10] https://english.aivd.nl/documents/2026/03/09/cybersecurity-advisory.-phishing-via-messaging-apps-signal-and-whatsapp
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aa78tuTHFvNLk1ml-VDtiQAAAQk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://whitepapers.theregister.com/
Secure messaging?
WhatsApp?
Pull the other one!
Re: Secure messaging?
It uses the Signal protocol which is open and has been reviewed by security experts. So, that's not the problem. There are, as far as I can tell, two problems: the "link device" feature, which allows sessions to be cloned and data shared, and whatever WhatsApp does on the server – there is no need to store the messages, which will remain securely encrypted, there but Facebook is desperate to monetise the metadata.
Re: Secure messaging?
You don't know it is using Signal protocol. Marketing and operational reality are two different things.
And even if it uses Signal protocol, it is trivial to add backdoors for any three letters agency.
The attack isn't what you think
End-to-end encryption protects messages in transit, but it does little if an attacker manages to log into the account itself.
At least when it comes to Signal, this is factually incorrect. Messages are only accessible to clients. But it is possible to clone the account with another device, in which case the data is shared between clients. This is convenient to be able to have a desktop client for longer chats, but does obviously pose a potential opening for attacks, but the main device is required to grant access for additional clients but can easily revoke it. I guess the mitigation here would be to disable linked devices.
The other possible attack, of course, would be to register with the phone number after persuading the account holder to give the confirmation code. In such cases, Signal will advise existing contacts that the account has changed devices – effectively the public key changes – and that users should check with the account owner. Currently, conversations will continue but it might make more sense to suspend them until the provenance has been clarified. This is not much different to other forms of identity theft, though I think the actual risk posed is less: unlike e-mail, you can't log into any service using a Signal account.
But I would have thought that anyone making attacks like this would also be targetting 2FA services from Microsoft, Google, etc. using the same approach.
Please Note.....................
....that NSO/Pegasus and Paragon/Graphite might already be embedded (ZERO CLICK malware) on your end point.
This means that the spooks DO NOT NEED access to e.g. Signal accounts.......
............because the snoops can read the plain text (silently) on your end point!
This news item is MISDIRECTION!
Remember Jamal Khashoggi!
Re: Please Note.....................
@AC
Then, of course, some of us do private encryption on air-gapped hardware..............................
...................before sending the encrypted messages over Signal.
The decryption is only ever done -- guess -- on air-gapped hardware...............
So.....snoops can try to break Signal E2EE.........before having a go at our private encryption..............
Russian hacking
The entire “Russian cyber campaign” described here appears to involve a remarkably advanced technique known in the trade as asking for the password .
No cryptography broken. No zero-day exploits. No quantum computer humming in a Siberian bunker. Just a message that effectively says: “Hi, this is support. Please send me your six-digit login code.” And apparently some officials reply, “Sure thing.”
Calling this hacking is a bit like reporting a “sophisticated burglary operation” because someone rang the doorbell and the homeowner let them in.
End-to-end encryption remains intact. Mathematics is fine. Elliptic curves are sleeping peacefully. The only compromised component in the system appears to be the human running the keyboard.
The funniest part is the solemn warning that Signal and WhatsApp “should not be used for classified information.” Quite right. Any security system collapses instantly if the user treats authentication codes like Pokémon cards and hands them to the first stranger who asks nicely.