Loading signal...
Signal
Submitted
Mar 9, 2026, 11:59 UTC
On 9 March 2026, Russian state hackers launched a global cyber campaign targeting Signal and WhatsApp accounts including Dutch government employees, using social engineering to steal security codes and access sensitive communications.
On 9 March 2026, Dutch intelligence confirmed that Russian state-sponsored hackers are conducting a large-scale global cyber campaign targeting Signal and WhatsApp messaging accounts belonging to dignitaries, military personnel, civil servants, journalists, and other persons of interest to the Russian government. The campaign uses phishing techniques, notably impersonating Signal Support chatbots and exploiting the 'linked devices' function, to trick users into revealing verification and pin codes. These codes allow hackers to take over accounts and access incoming messages, including group chats, exposing sensitive information. The campaign avoids technical exploits, instead leveraging legitimate app security features. Dutch services MIVD and AIVD issued a Cyber Advisory providing instructions on detecting compromised contacts and mitigating risks. Officials highlighted that despite end-to-end encryption, messaging apps should not be used for classified communications. The advisory provides detailed steps for identifying potential compromises within Signal group chats and recommends removing suspicious accounts. This campaign exhibits elements of Russian influence operations within digital communications, classified under Node 2: 5th Column.
Confidence: High
The event describes a discrete Russian cyberattack campaign targeting Signal and WhatsApp accounts of government and other sensitive personnel, confirmed by Dutch intelligence, thus constituting aggressor activity. It also involves Dutch security services' defense preparations via a public Cyber Advisory to mitigate the attack and identify compromises, supporting a dual classification.
Source URL
https://english.defensie.nl/latest/news/2026/03/09/russia-targets-signal-and-whatsapp-accounts-in-cyber-campaign
Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "bd9dee23-3564-42b0-8814-3572c7a56470",
"url": "https://english.defensie.nl/latest/news/2026/03/09/russia-targets-signal-and-whatsapp-accounts-in-cyber-campaign",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Netherlands",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"Russian state hackers",
"Signal",
"WhatsApp",
"cyber campaign",
"phishing",
"account takeover",
"Dutch intelligence",
"MIVD",
"AIVD",
"information theft",
"offensive cyber operations",
"end-to-end encryption",
"social engineering"
],
"nodes": [
"Node 2: 5th Column"
],
"countries": [
"Netherlands"
],
"where_text": "Cyberspace",
"headline": "Russia targets Signal and WhatsApp accounts in cyber campaign",
"description": "Russian state hackers are conducting a large-scale global cyber campaign targeting Signal and WhatsApp accounts of dignitaries, military personnel, civil servants, and journalists, including Dutch government employees. The campaign uses social engineering by masquerading as Signal Support chatbots or exploiting the 'linked devices' function to persuade targets to divulge security and pin codes, allowing account takeover. This enables hackers to read incoming messages, including in group chats, thereby accessing sensitive information. The campaign does not exploit technical vulnerabilities but instead abuses legitimate security features. Dutch intelligence services MIVD and AIVD issued a Cyber Advisory with guidance on identifying and responding to such attacks, cautioning that Signal and WhatsApp should not be used for classified or sensitive communication despite end-to-end encryption.",
"summary_short": "On 9 March 2026, Russian state hackers launched a global cyber campaign targeting Signal and WhatsApp accounts including Dutch government employees, using social engineering to steal security codes and access sensitive communications.",
"summary_extended": "On 9 March 2026, Dutch intelligence confirmed that Russian state-sponsored hackers are conducting a large-scale global cyber campaign targeting Signal and WhatsApp messaging accounts belonging to dignitaries, military personnel, civil servants, journalists, and other persons of interest to the Russian government. The campaign uses phishing techniques, notably impersonating Signal Support chatbots and exploiting the 'linked devices' function, to trick users into revealing verification and pin codes. These codes allow hackers to take over accounts and access incoming messages, including group chats, exposing sensitive information. The campaign avoids technical exploits, instead leveraging legitimate app security features. Dutch services MIVD and AIVD issued a Cyber Advisory providing instructions on detecting compromised contacts and mitigating risks. Officials highlighted that despite end-to-end encryption, messaging apps should not be used for classified communications. The advisory provides detailed steps for identifying potential compromises within Signal group chats and recommends removing suspicious accounts. This campaign exhibits elements of Russian influence operations within digital communications, classified under Node 2: 5th Column.",
"actor_primary": "Russian state hackers",
"target_primary": null,
"location_text": "Netherlands",
"location_region": null,
"location_coordinates_lat": null,
"location_coordinates_lon": null,
"location_precision": "Unknown",
"is_aggressor_signal": true,
"signal_type": "DEFENSE_PREP_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The event describes a discrete Russian cyberattack campaign targeting Signal and WhatsApp accounts of government and other sensitive personnel, confirmed by Dutch intelligence, thus constituting aggressor activity. It also involves Dutch security services' defense preparations via a public Cyber Advisory to mitigate the attack and identify compromises, supporting a dual classification.",
"event_time_utc": "2026-03-09T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "exact",
"created_at": "2026-03-09T11:59:00.028Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "unknown",
"time_precision_band": "exact",
"severity_band": "moderate",
"attribution_confidence_band": "high",
"attribution_basis": "independent_sources"
}Source reliability
B
Info credibility
3
Event time
Mar 9, 2026, 00:00 UTC
Event time confidence
exact
Location
Netherlands
Primary actor
Russian state hackers
Country
Netherlands
Countries
Netherlands
Tags
Russian state hackers, Signal, WhatsApp, cyber campaign, phishing, account takeover, Dutch intelligence, MIVD, AIVD, information theft, offensive cyber operations, end-to-end encryption, social engineering
Nodes
Node 2: 5th Column
Signal
Submitted
Mar 9, 2026, 11:59 UTC
On 9 March 2026, Russian state hackers launched a global cyber campaign targeting Signal and WhatsApp accounts including Dutch government employees, using social engineering to steal security codes and access sensitive communications.
On 9 March 2026, Dutch intelligence confirmed that Russian state-sponsored hackers are conducting a large-scale global cyber campaign targeting Signal and WhatsApp messaging accounts belonging to dignitaries, military personnel, civil servants, journalists, and other persons of interest to the Russian government. The campaign uses phishing techniques, notably impersonating Signal Support chatbots and exploiting the 'linked devices' function, to trick users into revealing verification and pin codes. These codes allow hackers to take over accounts and access incoming messages, including group chats, exposing sensitive information. The campaign avoids technical exploits, instead leveraging legitimate app security features. Dutch services MIVD and AIVD issued a Cyber Advisory providing instructions on detecting compromised contacts and mitigating risks. Officials highlighted that despite end-to-end encryption, messaging apps should not be used for classified communications. The advisory provides detailed steps for identifying potential compromises within Signal group chats and recommends removing suspicious accounts. This campaign exhibits elements of Russian influence operations within digital communications, classified under Node 2: 5th Column.
Confidence: High
The event describes a discrete Russian cyberattack campaign targeting Signal and WhatsApp accounts of government and other sensitive personnel, confirmed by Dutch intelligence, thus constituting aggressor activity. It also involves Dutch security services' defense preparations via a public Cyber Advisory to mitigate the attack and identify compromises, supporting a dual classification.
Source URL
https://english.defensie.nl/latest/news/2026/03/09/russia-targets-signal-and-whatsapp-accounts-in-cyber-campaign
Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "bd9dee23-3564-42b0-8814-3572c7a56470",
"url": "https://english.defensie.nl/latest/news/2026/03/09/russia-targets-signal-and-whatsapp-accounts-in-cyber-campaign",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Netherlands",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"Russian state hackers",
"Signal",
"WhatsApp",
"cyber campaign",
"phishing",
"account takeover",
"Dutch intelligence",
"MIVD",
"AIVD",
"information theft",
"offensive cyber operations",
"end-to-end encryption",
"social engineering"
],
"nodes": [
"Node 2: 5th Column"
],
"countries": [
"Netherlands"
],
"where_text": "Cyberspace",
"headline": "Russia targets Signal and WhatsApp accounts in cyber campaign",
"description": "Russian state hackers are conducting a large-scale global cyber campaign targeting Signal and WhatsApp accounts of dignitaries, military personnel, civil servants, and journalists, including Dutch government employees. The campaign uses social engineering by masquerading as Signal Support chatbots or exploiting the 'linked devices' function to persuade targets to divulge security and pin codes, allowing account takeover. This enables hackers to read incoming messages, including in group chats, thereby accessing sensitive information. The campaign does not exploit technical vulnerabilities but instead abuses legitimate security features. Dutch intelligence services MIVD and AIVD issued a Cyber Advisory with guidance on identifying and responding to such attacks, cautioning that Signal and WhatsApp should not be used for classified or sensitive communication despite end-to-end encryption.",
"summary_short": "On 9 March 2026, Russian state hackers launched a global cyber campaign targeting Signal and WhatsApp accounts including Dutch government employees, using social engineering to steal security codes and access sensitive communications.",
"summary_extended": "On 9 March 2026, Dutch intelligence confirmed that Russian state-sponsored hackers are conducting a large-scale global cyber campaign targeting Signal and WhatsApp messaging accounts belonging to dignitaries, military personnel, civil servants, journalists, and other persons of interest to the Russian government. The campaign uses phishing techniques, notably impersonating Signal Support chatbots and exploiting the 'linked devices' function, to trick users into revealing verification and pin codes. These codes allow hackers to take over accounts and access incoming messages, including group chats, exposing sensitive information. The campaign avoids technical exploits, instead leveraging legitimate app security features. Dutch services MIVD and AIVD issued a Cyber Advisory providing instructions on detecting compromised contacts and mitigating risks. Officials highlighted that despite end-to-end encryption, messaging apps should not be used for classified communications. The advisory provides detailed steps for identifying potential compromises within Signal group chats and recommends removing suspicious accounts. This campaign exhibits elements of Russian influence operations within digital communications, classified under Node 2: 5th Column.",
"actor_primary": "Russian state hackers",
"target_primary": null,
"location_text": "Netherlands",
"location_region": null,
"location_coordinates_lat": null,
"location_coordinates_lon": null,
"location_precision": "Unknown",
"is_aggressor_signal": true,
"signal_type": "DEFENSE_PREP_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The event describes a discrete Russian cyberattack campaign targeting Signal and WhatsApp accounts of government and other sensitive personnel, confirmed by Dutch intelligence, thus constituting aggressor activity. It also involves Dutch security services' defense preparations via a public Cyber Advisory to mitigate the attack and identify compromises, supporting a dual classification.",
"event_time_utc": "2026-03-09T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "exact",
"created_at": "2026-03-09T11:59:00.028Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "unknown",
"time_precision_band": "exact",
"severity_band": "moderate",
"attribution_confidence_band": "high",
"attribution_basis": "independent_sources"
}Source reliability
B
Info credibility
3
Event time
Mar 9, 2026, 00:00 UTC
Event time confidence
exact
Location
Netherlands
Primary actor
Russian state hackers
Country
Netherlands
Countries
Netherlands
Tags
Russian state hackers, Signal, WhatsApp, cyber campaign, phishing, account takeover, Dutch intelligence, MIVD, AIVD, information theft, offensive cyber operations, end-to-end encryption, social engineering
Nodes
Node 2: 5th Column