Russian hackers are targeting Signal and WhatsApp accounts in a large-scale cyberattack, according to a warning from Dutch intelligence agencies (AIVD and MIVD).
The primary targets of the campaign include government officials, military personnel, and journalists. While the warning does not specify the number of victims or which specific Russian intelligence services or hacking groups are behind the attack, it highlights a significant threat to secure communications.
Hacking Methods Used by Russian Hackers
During the attacks, hackers contact users via chat and use social engineering to trick them into revealing security codes. Once obtained, these codes grant the attackers access to private messages and group conversations. Perpetrators frequently pose as official technical support bots, such as “Signal Support.” According to Dutch intelligence, Russian cybercriminals have likely already succeeded in accessing confidential information from several government employees and media representatives.
Another common method involves the unauthorized use of the “linked devices” feature in the Signal app. Intelligence officials noted that users can spot signs of compromise themselves. Indicators of a hacked account may include duplicate contacts in the address book or phone numbers that suddenly appear with a “deleted account” status.
MIVD Director Pieter Reesink emphasized that despite the use of end-to-end encryption, popular messengers like Signal and WhatsApp should not be used to transmit secret, confidential, or sensitive information.
Dutch authorities have urged users never to share verification codes with others, to avoid scanning unknown QR codes, and to ignore any messages claiming to be from Signal’s support service.
How to Check Your Accounts: A Detailed Guide
NEWSROOM IN notes that users should follow these steps to check their accounts in popular messengers and disconnect unauthorized users if a profile has been compromised:
Checking linked devices in WhatsApp
Open the WhatsApp app on your smartphone. Android users should tap the three-dot icon in the top right corner and select “Linked devices.” iPhone owners should tap the “Settings” gear icon in the bottom right corner and also navigate to “Linked devices.” This will display a list of all computers and browsers with access to your correspondence, including the time of their last activity. Review this list carefully. If you find a device you do not recognize or a suspicious location, simply tap that device and select “Log Out.” The attacker will immediately lose access to your chats.
Checking linked devices in Signal
Open the Signal app on your phone. Tap your profile icon (either your photo or initials) in the top left corner. In the settings menu, find and select “Linked devices.” Check the list of all connected gadgets. If you see an unfamiliar device, tap it (or swipe left, depending on your phone’s operating system) and confirm by selecting “Unlink” or “Delete.”
Additional protection against account hijacking
To prevent future attacks, enable two-step verification (PIN) in the privacy settings of both messengers. Remember the core rule of digital hygiene emphasized by intelligence services: the actual support teams for Signal and WhatsApp will never send you direct messages or ask you to provide a verification code from an SMS. Anyone requesting these numbers is a fraudster.
