Signal has issued a security warning to users after reports of a targeted scam campaign aimed at high-profile individuals, including government officials and journalists.
The alert follows findings from Dutch intelligence agencies that attackers are using phishing and impersonation tactics, not technical hacking, to gain access to user accounts.
What Actually Happened
According to the General Intelligence and Security Service and the Military Intelligence and Security Service:
- A large-scale cyber campaign targeted selected individuals of interest
- Targets included:
- Civil servants
- Military personnel
- Journalists and public figures
- The campaign is believed to be linked to actors aligned with Russian interests
Attackers reportedly:
- Posed as support staff from messaging platforms
- Attempted to trick users into sharing:
- Verification (SMS) codes
- Account PINs
- Personal information
Important Clarification: No Platform Breach
Signal has clearly stated:
- Its systems have not been compromised
- End-to-end encryption remains intact
- The attacks are focused on users, not the platform itself
This means:
- Signal was not hacked
- Accounts were targeted through social engineering
The same risk applies to WhatsApp and similar platforms.
How the Scam Works
These attacks rely on simple but effective techniques:
- Fake messages pretending to be official support
- Urgent requests to “verify” or “secure” accounts
- Requests for:
- SMS verification codes
- Signal PIN
- Links or prompts designed to create panic or urgency
Once a user shares this information, attackers can:
- Take control of the account
- Access conversations
- Link the account to other devices
Why This Matters
Cybersecurity experts highlight a growing trend:
- Attackers are shifting from technical exploits to human-focused attacks
- Even highly secure apps can be compromised if the user is tricked
End-to-end encryption protects messages in transit, but:
- It cannot protect accounts if login credentials are exposed
- Device-level compromise bypasses app-level security
How to Stay Safe
To protect your account:
- Never share your verification code with anyone
- Do not reveal your Signal PIN under any circumstances
- Ignore messages claiming to be “support” asking for sensitive data
- Enable additional security features within the app
- Regularly check linked devices and active sessions
- Block and report suspicious contacts
Key Takeaway
This incident is not a breach of Signal’s systems, but a reminder of a critical reality:
The biggest vulnerability is often the user, not the technology.
Even the most secure apps can be compromised if users are deceived into giving access.
Verified and Official Sources
- https://www.signal.org/blog/
- https://www.aivd.nl
- https://english.defensie.nl/topics/military-intelligence-and-security-service
- https://www.cisa.gov/news-events/alerts
- https://www.ncsc.nl
