Russian hackers are actively hacking Signal and WhatsApp accounts

Dutch intelligence agencies have reported a new large-scale cyber campaign, which is associated with Russian state hacking groups. According to intelligence, the attackers are trying to gain access to the accounts of officials, military personnel and other potentially interesting targets in popular messengers.

These are the Signal and WhatsApp services, which are widely used for personal and business communication.

The campaign targets the accounts of officials and military personnel

The Dutch intelligence and security services – MIVD and AIVD – warn that among the targets of the attack are already Dutch civil servants.

According to the agencies, other categories of users who are of interest to the Russian authorities are also at risk. In particular, it may concern journalists and other public figures.

The intelligence services note that the campaign is international in nature and may affect users outside the Netherlands.

The attacks are carried out without malware

The attackers convince the victims to give them the confirmation codes and PIN codes necessary to log in to the account. To do this, they disguise themselves as chatbots of the messenger support service or service representatives.

Thus, the messengers themselves are not hacked – the compromise occurs at the level of individual users.

The “linked devices” feature is used

Another way to gain access is through the Signal and WhatsApp additional device connection feature.

Once the account is taken over, hackers can connect their own device to the victim’s profile. This allows them to read incoming messages, including group chats.

According to Dutch intelligence, the campaign participants have likely already used the access to collect sensitive information.