On 9 March 2026, Dutch intelligence confirmed a large-scale Russian cyber campaign targeting Signal and WhatsApp accounts of dignitaries, military personnel, and civil servants, including Dutch government employees.

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

AggressorDefense

Summary

Dutch intelligence and security services MIVD and AIVD confirmed on 9 March 2026 that Russian state hackers are conducting a global cyber campaign targeting Signal and WhatsApp accounts belonging to dignitaries, military personnel, civil servants, and possibly journalists of interest to Russia. The campaign involves tricking users into revealing security verification and PIN codes by impersonating Signal Support chatbots and exploiting 'linked devices' functions to take over accounts. Once compromised, hackers can access incoming messages, including sensitive group chats, potentially acquiring sensitive information. This campaign does not exploit technical vulnerabilities but abuses legitimate app security features. The Dutch services warn against using Signal or WhatsApp for classified information despite their end-to-end encryption. To counter the campaign, MIVD and AIVD released a Cyber Advisory with detection and response measures for potentially compromised contacts on Signal chats. The campaign is ongoing and poses a serious threat to secure communication channels used by government and civil society actors.

Classification

Confidence: High

The event explicitly describes hostile Russian cyber activities targeting Signal and WhatsApp accounts of Dutch government and other sensitive users, confirming aggressor actions. The Dutch services’ publication of a Cyber Advisory and guidance for detection and response constitutes defense preparation.

Source URL

https://english.aivd.nl/latest/news/2026/03/09/russia-targets-signal-and-whatsapp-accounts-in-cyber-campaign

Open source

Provenance

Publisher: extension
Submitted: Mar 10, 2026, 10:51 UTC
Last updated: Nov 8, 2026, 19:42 UTC
Event time: Mar 9, 2026, 00:00 UTC

Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "a9f49a3d-d6b3-47d3-b1c6-14330bb5d44a",
  "url": "https://english.aivd.nl/latest/news/2026/03/09/russia-targets-signal-and-whatsapp-accounts-in-cyber-campaign",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Netherlands",
  "source_reliability": "A",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "Russian state hackers",
    "cyber campaign",
    "Signal",
    "WhatsApp",
    "phishing",
    "offensive cyber operations",
    "Dutch intelligence",
    "MIVD",
    "AIVD",
    "account compromise",
    "end-to-end encryption"
  ],
  "nodes": [],
  "countries": [
    "Netherlands"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "Russian state hackers are engaged in a large-scale global cyber campaign to gain access to Signal and WhatsApp accounts of dignitaries, military personnel, civil servants, and journalists. The Dutch intelligence services MIVD and AIVD confirmed that Dutch government employees are among the victims. The attackers primarily use phishing methods by impersonating Signal Support chatbots to elicit security codes from users, and also exploit legitimate features such as the 'linked devices' functionality to take control of accounts. Once compromised, hackers can read incoming messages including group chats, posing a risk of sensitive information exposure. The campaign does not exploit vulnerabilities in the apps but misuses legitimate security features. Dutch agencies advise against using these apps for classified or sensitive information despite end-to-end encryption and have published a Cyber Advisory to help users identify and respond to such attacks.",
  "summary_short": "On 9 March 2026, Dutch intelligence confirmed a large-scale Russian cyber campaign targeting Signal and WhatsApp accounts of dignitaries, military personnel, and civil servants, including Dutch government employees.",
  "summary_extended": "Dutch intelligence and security services MIVD and AIVD confirmed on 9 March 2026 that Russian state hackers are conducting a global cyber campaign targeting Signal and WhatsApp accounts belonging to dignitaries, military personnel, civil servants, and possibly journalists of interest to Russia. The campaign involves tricking users into revealing security verification and PIN codes by impersonating Signal Support chatbots and exploiting 'linked devices' functions to take over accounts. Once compromised, hackers can access incoming messages, including sensitive group chats, potentially acquiring sensitive information. This campaign does not exploit technical vulnerabilities but abuses legitimate app security features. The Dutch services warn against using Signal or WhatsApp for classified information despite their end-to-end encryption. To counter the campaign, MIVD and AIVD released a Cyber Advisory with detection and response measures for potentially compromised contacts on Signal chats. The campaign is ongoing and poses a serious threat to secure communication channels used by government and civil society actors.",
  "actor_primary": "Russian state hackers",
  "target_primary": null,
  "location_text": "Netherlands",
  "location_region": null,
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Unknown",
  "is_aggressor_signal": true,
  "signal_type": "DEFENSE_PREP_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The event explicitly describes hostile Russian cyber activities targeting Signal and WhatsApp accounts of Dutch government and other sensitive users, confirming aggressor actions. The Dutch services’ publication of a Cyber Advisory and guidance for detection and response constitutes defense preparation.",
  "event_time_utc": "2026-03-09T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-03-10T10:51:00.058Z",
  "updated_at": "2026-11-08T19:42:52.699Z",
  "reliability_band": "strong",
  "location_precision_band": "unknown",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighIndependence confirmedTime: Same dayLocation: Unknown

Source reliability

Info credibility

Event time

Mar 9, 2026, 00:00 UTC

Event time confidence

pm24h

Location

Netherlands

Primary actor

Russian state hackers

Country

Netherlands

Countries

Netherlands

Tags

Russia, Russian state hackers, cyber campaign, Signal, WhatsApp, phishing, offensive cyber operations, Dutch intelligence, MIVD, AIVD, account compromise, end-to-end encryption

Loading signal...

{ "id": "a9f49a3d-d6b3-47d3-b1c6-14330bb5d44a", "url": "https://english.aivd.nl/latest/news/2026/03/09/russia-targets-signal-and-whatsapp-accounts-in-cyber-campaign", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Netherlands", "source_reliability": "A", "info_credibility": "3", "tags": [ "Russia", "Russian state hackers", "cyber campaign", "Signal", "WhatsApp", "phishing", "offensive cyber operations", "Dutch intelligence", "MIVD", "AIVD", "account compromise", "end-to-end encryption" ], "nodes": [], "countries": [ "Netherlands" ], "where_text": "Cyberspace", "headline": null, "description": "Russian state hackers are engaged in a large-scale global cyber campaign to gain access to Signal and WhatsApp accounts of dignitaries, military personnel, civil servants, and journalists. The Dutch intelligence services MIVD and AIVD confirmed that Dutch government employees are among the victims. The attackers primarily use phishing methods by impersonating Signal Support chatbots to elicit security codes from users, and also exploit legitimate features such as the 'linked devices' functionality to take control of accounts. Once compromised, hackers can read incoming messages including group chats, posing a risk of sensitive information exposure. The campaign does not exploit vulnerabilities in the apps but misuses legitimate security features. Dutch agencies advise against using these apps for classified or sensitive information despite end-to-end encryption and have published a Cyber Advisory to help users identify and respond to such attacks.", "summary_short": "On 9 March 2026, Dutch intelligence confirmed a large-scale Russian cyber campaign targeting Signal and WhatsApp accounts of dignitaries, military personnel, and civil servants, including Dutch government employees.", "summary_extended": "Dutch intelligence and security services MIVD and AIVD confirmed on 9 March 2026 that Russian state hackers are conducting a global cyber campaign targeting Signal and WhatsApp accounts belonging to dignitaries, military personnel, civil servants, and possibly journalists of interest to Russia. The campaign involves tricking users into revealing security verification and PIN codes by impersonating Signal Support chatbots and exploiting 'linked devices' functions to take over accounts. Once compromised, hackers can access incoming messages, including sensitive group chats, potentially acquiring sensitive information. This campaign does not exploit technical vulnerabilities but abuses legitimate app security features. The Dutch services warn against using Signal or WhatsApp for classified information despite their end-to-end encryption. To counter the campaign, MIVD and AIVD released a Cyber Advisory with detection and response measures for potentially compromised contacts on Signal chats. The campaign is ongoing and poses a serious threat to secure communication channels used by government and civil society actors.", "actor_primary": "Russian state hackers", "target_primary": null, "location_text": "Netherlands", "location_region": null, "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Unknown", "is_aggressor_signal": true, "signal_type": "DEFENSE_PREP_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The event explicitly describes hostile Russian cyber activities targeting Signal and WhatsApp accounts of Dutch government and other sensitive users, confirming aggressor actions. The Dutch services’ publication of a Cyber Advisory and guidance for detection and response constitutes defense preparation.", "event_time_utc": "2026-03-09T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-03-10T10:51:00.058Z", "updated_at": "2026-11-08T19:42:52.699Z", "reliability_band": "strong", "location_precision_band": "unknown", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }