Russian government hackers targeting Signal and WhatsApp users, Dutch spies warn

Dutch intelligence agencies issued a warning on Monday about a large-scale global hacking campaign by Russian state actors against users of the Signal and WhatsApp messaging apps. The Netherlands Defence Intelligence and Security Service and the General Intelligence and Security Service said the targets include government and military officials as well as journalists worldwide. The agencies accused the hackers of relying on phishing and social engineering techniques instead of malware to take over accounts. For Signal, the hackers masquerade as the apps support team and send messages warning of suspicious activity, a possible data leak or attempts to access private data. If successful, they obtain a verification code requested from Signal via SMS and the targets PIN code. They then use the codes to register a new device with a new phone number, impersonate the target and access contacts while locking the original user out of the account. Because Signal stores chat history locally on the phone, a victim can regain access after re-registering their number and may assume nothing is wrong. The Dutch services stressed that this assumption could be incorrect. Signal does not provide support directly through the app, and adding a new device does not typically grant access to previous messages. The hackers are also trying to trick targets on both apps into scanning malicious QR codes or clicking malicious links that link the actors device to the victims account. On WhatsApp, the hackers abuse the linked devices function to potentially read past messages. Victims may not realize they have granted access because they are not logged out of their accounts. Signal responded by posting advice on social media that users should never share their SMS verification code or PIN. Meta spokesperson Zade Alsawah said WhatsApp recommends never sharing the six-digit code and directed users to help pages on suspicious messages and the linked devices feature. A spokesperson for the Dutch Ministry of Defence declined to provide more details, and the Russian embassy in Washington did not respond to a request for comment.