Overview
- The AIVD and MIVD report an active, large-scale global operation targeting officials, military personnel and journalists, with Dutch government employees among confirmed victims.
- Attackers impersonate a fake “Signal Support” chatbot to trick users into sharing SMS verification codes and PINs required to take over accounts.
- The campaign also abuses Signal and WhatsApp linked‑devices features via malicious QR codes or links, allowing attacker-controlled devices to receive messages and monitor group chats.
- Dutch authorities say the hackers have likely accessed sensitive information and advise that consumer messaging apps should not carry classified or confidential communications.
- Signal states its infrastructure and encryption remain uncompromised and warns support will never ask for codes, while WhatsApp urges users never to share their six-digit code and highlights existing protections.