Russia is “engaged in a large-scale global attempt” to take over Signal and WhatsApp accounts, two Dutch intelligence agencies said Monday, adding to warnings issued by several groups about the security risk to the messaging apps.
According to the agencies, hackers are using phishing techniques to target high-profile individuals, posing as accounts with names like “Signal support” and securing details from users that would allow them account access.
Signal is believed to be one of the most secure messaging platforms available. It is a common battlefield messaging tool among the Ukrainian military and last year it became the subject of a White House scandal when a group of top officials accidentally added a journalist to a group chat discussing military strikes in Yemen.
Now, according to the Dutch report, Russian intelligence has launched a vast campaign to break into Signal and WhatsApp accounts,. The scheme has already compromised the messages of Dutch government employees, the report said, adding that it is “probable that targets include other persons of interest to the Russian government, such as journalists.”
Russia’s Ministry of Foreign Affairs did not respond to a request for comment.
The warning follows a similar one issued by Germany in February, saying that unidentified hackers were trying to phish high-profile Signal users in German military and politics.
Last year, Google said it had identified Russian actors trying to phish Signal accounts associated with the Ukrainian military, and warned that the tactic would likely spread.
“We are aware of recent reports regarding targeted phishing attacks that have resulted in account takeovers of some Signal users, including government officials and journalists. We take this very seriously,” the company posted on social media, alongside an example phishing message.
Hackers have long targeted WhatsApp, owned by Meta, which as of last year claimed to have more than three billion active monthly users. But Signal, operated by a nonprofit, is far less popular and uses a complex type of encryption designed to be unbreakable, even by a theoretical advanced quantum computer.
While Signal verifies a new user’s account by texting their phone number, the app deliberately does not show users’ phone numbers to each other as a way to better protect their privacy. However, that can make a scam message seem more convincing, since a user who receives a message that comes from “Signal support” — not a real service Signal offers — can’t check the phone number associated with the account to see if it’s suspicious.
A WhatsApp spokesperson declined to comment but recommended users never share their login information with other people and recommended its scam protection guide.
