Russian phishing campaign hijacks Signal and WhatsApp accounts, later targeting Signal backups
Russian-linked attackers hijacked thousands of messaging accounts, targeting officials, military personnel and journalists. Never share verification codes, PINs or backup keys; check linked devices and replace any exposed Signal backup key.
Never give anyone your verification codes, PINs or backup recovery keys; block and report messages claiming to be Signal support. Review linked devices in Signal and WhatsApp and remove anything you do not recognise. If you shared a Signal backup recovery key, generate a new one in Settings and warn your contacts through another channel; involve your workplace security team if work conversations were exposed.
What’s happening
Dutch intelligence disclosed the campaign on 9 March, confirming that Russian state hackers had targeted and compromised individual Signal and WhatsApp accounts. Fake support messages sought verification codes and PINs, while other lures persuaded people to link an attacker's device. The FBI and CISA subsequently reported thousands of compromised messaging accounts worldwide, with their reporting specifically identifying Signal targets. Access allowed attackers to read messages, impersonate victims and approach their contacts. By June, the campaign also sought Signal backup recovery keys to obtain historical conversations. Dutch intelligence confirmed that sensitive information had been collected. The agencies said the applications and their encryption had not been compromised: this is phishing, with no software flaw to patch. Replacing an exposed backup key blocks future downloads using that key but cannot retrieve data already copied. As at 3 November, the latest official development found was the 30 June warning; the reviewed sources announce no end to the campaign or final victim total.
- What
- Scam
- Affects
- Signal and WhatsApp accounts
- Fixed in
- Nothing to patch
- Since
- 9 Mar 2026
- Closed
- 30 June 2026
Timeline
- Update
AIVD and MIVD corroborated the backup-key attacks through their own research and said the campaign remained widespread and successful. They confirmed that Russian attackers had collected sensitive information.
- Wider attacks
The FBI and CISA warned that the continuing campaign now sought backup recovery keys, exposing historical messages as well as accounts. They identified actors publicly tracked as UNC5792 and UNC4221 and advised victims to generate replacement keys.
- Update
CORRECTIV reported that former German intelligence deputy chief Arndt Freytag von Loringhoven's Signal account had been taken over and used to send phishing invitations to contacts. Its investigation found Russian connections, while acknowledging it had no direct evidence of Russian state involvement.
- Wider attacks
The FBI and CISA said the global campaign had compromised thousands of messaging accounts. Their reporting specifically identified Signal targets, including officials, military personnel, political figures and journalists.
- Made publicNothing to patch
Dutch intelligence services AIVD and MIVD disclosed a Russian campaign targeting Signal and WhatsApp accounts, including confirmed Dutch government victims. Attackers impersonated support services to obtain codes and PINs, and abused device linking.
Sources
- Staying Safe from Phishing, Scams, and ImpersonationSignal
- Russia targets Signal and WhatsApp accounts in cyber campaignAIVD · 9 Mar 2026
- Russian Intelligence Services Target Commercial Messaging Application AccountsFBI and CISA · 20 Mar 2026
- Signal and WhatsApp accounts targeted in phishing campaignMalwarebytes · 10 Mar 2026
- Signal Phishing Attack: Digital Evidence Points to RussiaCORRECTIV · 24 Mar 2026
- Russian Intelligence Services Continue to Target Commercial Messaging ApplicationsFBI and CISA · 26 June 2026
- Russische hackers richten zich op Signal-backups via nieuwe phishing-methodeAIVD · 30 June 2026