Russian government hackers targeting Signal and WhatsApp users, Dutch spies warn

A recent alert from Dutch intelligence agencies reveals that Russian government hackers are actively targeting users of Signal and WhatsApp. The focus appears to be on government officials, military personnel, and journalists across the globe. The Netherlands' Defence Intelligence and Security Service (MIVD) and the General Intelligence and Security Service (AIVD) have detailed a significant hacking campaign aimed at these popular messaging platforms. The report accuses Russian state actors of employing phishing and social engineering strategies, steering clear of traditional malware methods. In cases involving Signal, hackers pose as support representatives, directly messaging users with alarming warnings about potential data leaks or suspicious account activity. If victims fall for these traps, they are asked to provide verification codes sent via SMS, which the hackers then use to gain access to the victims' accounts. Once the hackers acquire the verification and PIN codes, they can register a new device linked to a different phone number, effectively impersonating the victim and potentially accessing their contacts. Disturbingly, victims may believe their accounts remain secure since Signal allows users to retain their chat histories locally, leading them to mistakenly assume they are unaffected by the breach. Additionally, the report indicates that hackers are also utilizing tactics such as sending malicious QR codes or links to lure users into granting access to their accounts. For WhatsApp, vulnerabilities in the “Linked Devices” functionality are being exploited, enabling unauthorized access to past messages without the victim's immediate awareness. To counter these threats, Meta, the parent company of WhatsApp, advises users never to share their six-digit verification codes and directs them to resources for identifying suspicious messages. As concerns mount, both the Dutch and Russian governments have remained silent on requests for further information, although the tactics described align with known strategies employed by Russian hackers amid ongoing geopolitical tensions, particularly related to the conflict in Ukraine.