Overview
- Netherlands’ AIVD and MIVD say a large-scale, global effort targets government, military and journalist accounts, with Dutch employees confirmed among victims.
- The agencies report attackers often pose as a fake “Signal Support” chatbot to harvest SMS verification codes and Signal PINs for account takeovers.
- Threat actors also exploit QR-based and linked‑devices features to quietly add attacker-controlled devices, enabling access to messages and group chats.
- Officials warn sensitive information has likely been exposed, while stressing that Signal and WhatsApp infrastructure remains uncompromised and only individual accounts are affected.
- Dutch authorities issued a cyber advisory with mitigation steps, and WhatsApp and Signal urge users to never share verification codes, review linked devices and watch for duplicate or “deleted account” entries in chats.