Russian Hackers Target Signal, WhatsApp Users to Steal Verification Codes – Center for Countering Disinformation

Kremlin-Linked Hackers Target Signal and WhatsApp Accounts in Sophisticated Campaign

Russian hackers with ties to the Kremlin have launched an extensive operation to compromise Signal and WhatsApp accounts belonging to high-profile individuals, according to intelligence reports. The Dutch intelligence services AIVD and MIVD have identified military personnel, government officials, diplomats, and journalists as primary targets in this coordinated attack.

The Center for Countering Disinformation (CCD) issued a warning about the campaign, noting that rather than attempting to break the messaging platforms’ encryption systems directly, the hackers are employing sophisticated social engineering tactics to trick users into surrendering their verification codes and PINs.

“These attackers are using human vulnerability rather than technical exploits,” explained a cybersecurity expert familiar with the investigation. “It’s often easier to manipulate people than to crack robust encryption protocols.”

One of the most prevalent strategies involves fake chatbots masquerading as official “Signal support service” representatives. When users engage with these deceptive bots, they’re prompted to provide sensitive verification information that grants hackers access to their accounts.

The attackers have also exploited Signal’s “linked devices” functionality, which allows users to access their accounts from multiple devices. Once hackers gain this access, they can covertly monitor conversations and view private chat groups without the victim’s knowledge.

Signal has officially acknowledged these attacks while emphasizing that its underlying infrastructure remains secure. The company stressed that account compromises occur only when users inadvertently share their verification credentials with malicious actors.

“The integrity of our encryption hasn’t been compromised,” a Signal representative confirmed. “These incidents stem from users being deceived into sharing access credentials, not from any weakness in our security architecture.”

The targeting of encrypted messaging platforms represents a significant evolution in Russian cyber operations. Secure messaging apps like Signal and WhatsApp have become essential communication tools for government officials, journalists, and military personnel who need to exchange sensitive information securely.

By compromising these accounts, Russian intelligence could potentially gain access to confidential communications, track operational planning, and identify networks of contacts. This information could be leveraged for future cyberattacks, disinformation campaigns, or traditional espionage operations.

The CCD has issued specific guidelines to help users protect themselves against these attacks. “No legitimate messenger support service will ever request your verification code or PIN via chat,” the center emphasized. “Users should regularly check the list of connected devices in their application settings and be alert to any unusual activity.”

Security experts also recommend enabling additional security features like registration locks and two-factor authentication when available. Users should be particularly wary of unexpected messages claiming to be from support services, even if they appear authentic.

This campaign reflects a broader trend of state-backed cyber operations targeting personal communications. Similar tactics have been observed in other influence operations attributed to Russian intelligence services, which frequently combine technical exploits with social engineering to achieve their objectives.

The attacks come amid heightened tensions between Russia and Western nations, with cyber operations increasingly serving as a tool for intelligence gathering and political influence. Intelligence agencies have noted an uptick in Russian cyber activities targeting government, defense, and media sectors in recent months.

For users of encrypted messaging platforms, the CCD advises immediate action if suspicious activity is detected: “If you notice ‘duplicates’ of contacts or unknown participants in groups, immediately notify the administrator and change your security settings.”

As digital communication continues to be essential for sensitive discussions, security experts emphasize that technical protections must be combined with user vigilance to effectively counter these sophisticated threats.