Dutch intelligence agencies warn that Russian-backed hackers are targeting officials, military personnel, and journalists by aiming to take over Signal and WhatsApp accounts through social engineering and manipulation of legitimate security features.

Attackers rely on impersonating customer support to obtain verification codes, abusing linked devices, and using malicious QR codes to gain access to accounts and read private conversations and group chats.

Authorities caution against sharing security details or clicking unverified links, stressing the importance of verifying the requester’s identity.

Officials continue to update the public as new information emerges about the campaign.

Security guidance emphasizes that Signal and WhatsApp remain secure platforms; the risk lies with individual devices and accounts, not with the apps’ core infrastructure.

The advisory does not disclose victim counts or name a specific Russian group, noting ongoing Western intelligence assessments of Russian cyber operations.

The warning comes from the Netherlands’ military intelligence service and domestic intelligence agency in a joint advisory issued on March 9, 2026.

The advisory aims to mitigate risk and protect prominent individuals and sensitive communications from intrusions.

Recommendations include reviewing linked devices, disabling unidentified connections, and enabling a device re-registration PIN.

WhatsApp cautions users not to share six-digit verification codes and highlights ongoing protections; Signal did not immediately comment.

Preventative steps include rotating and reviewing linked devices, linking devices only via personal QR codes, and recognizing that customer support will not request verification codes.

Users should review and remove unknown devices, avoid sharing sensitive information via messaging apps unless approved, and verify invitations or QR codes through trusted channels.