Foreign state-backed hackers are targeting the WhatsApp and Signal accounts of government officials, diplomats, military personnel, and other high-value users, according to a security alert issued Wednesday by Portugal’s Security Intelligence Service (SIS).

Described as a global cyberespionage campaign, Portuguese officials say the operation is designed to compromise individual accounts to extract privileged information from Portugal and allied countries.

Portugal did not identify the origin of the alleged foreign attackers.

The SIS advisory echoes a similar warning issued by intelligence agencies in the Netherlands on Monday, stating that Russian-linked hackers had launched a worldwide cyber campaign, also attempting to gain access to Signal and WhatsApp accounts.

The warning further stated that the Kremlin-backed attackers were also targeting officials, military personnel, and journalists.

And last November, the US Cybersecurity and Infrastructure Agency (CISA) also issued a major alert regarding threat actors using encrypted messaging apps like WhatsApp, Signal, and Telegram to deliver spyware and phishing attacks – notably against high-value targets in the US, the Middle East, and Europe.

Attackers trick users instead of breaking into apps

Although WhatsApp and Signal both use end-to-end encryption, SIS warns that attackers are tricking users into handing over access to their accounts, rather than exploiting security vulnerabilities in the platforms themselves.

The foreign adversaries, instead, are relying on social engineering tactics, including phishing, fake technical support, malicious links, QR-code lures, and impersonation of trusted contacts, the seven-page SIS alert states.

“Attackers do not compromise the WhatsApp or Signal apps or their encryption. Their goal is to push users into taking actions that break the security of their own accounts,” the intelligence agency said in the report, translated from Portuguese.

The alert also warns that AI is increasingly being used to make those scams more believable – including by mimicking support staff, cloning familiar voices or identities, and carrying out more fluent conversations by message, phone call, or video.

Stolen accounts can expose chats and fuel new phishing

Once inside the apps, SIS says hostile actors can access one-on-one chats, group conversations, and shared files, and even use the victim’s identity to launch fresh phishing attacks against their contacts.

Additionally, the attackers could not only maintain long-term access to the accounts unbeknownst to the user, but also add unauthorized devices to accounts or lock out legitimate users.

The agency is urging all at-risk users to always:

• Verify new contacts through another channel
• Never share credentials or verification codes
• Limit QR-code scans,
• Tighten privacy settings,
• Block unauthorized group additions.

Earlier this week, Signal released a statement saying it was aware of the recent reports and takes them seriously.

“Signal’s encryption and infrastructure have not been compromised and remain robust. These attacks were executed via sophisticated phishing campaigns, designed to trick users into sharing information – SMS codes and/or Signal PIN – to gain access to users’ accounts,” the chat app posted on X.

A spate of WhatsApp hacking attacks last year led the White House to ban the use of WhatsApp on the personal devices of members of Congress and other high-ranking US officials.

---

Unlock more exclusive Cybernews content on YouTube.