TL;DR: A state-backed phishing campaign is targeting government sources and journalists through Signal and WhatsApp by abusing trust, direct-message prompts, and account re-registration rather than technical exploits, according to Swarmnetics and the Dutch Ministry of Defence. The pattern shows that messaging security still depends on user verification and account recovery controls, not encryption alone.
At a glance
What this is: A phishing campaign is using Signal and WhatsApp trust assumptions, not platform vulnerabilities, to target government sources and journalists.
Why it matters: It matters because identity security teams must govern messaging-account verification, recovery and linked-device control, not assume end-to-end encryption neutralises impersonation risk.
Context
Signal and WhatsApp are designed to protect message content, but that does not stop attackers from abusing the human layer around account recovery, device linking and trust in direct messages. In this case, the security gap is not cryptographic failure but identity verification failure inside high-trust messaging workflows.
For government, diplomatic and investigative environments, the risk is especially acute because a single compromised messaging identity can expose contacts, group memberships and sensitive conversation history. The article describes a pattern that is operationally simple but governance-heavy, and that is exactly why it remains effective against targeted users.
Key questions
Q: What breaks when messaging apps rely on user verification alone?
A: User verification alone breaks when attackers can impersonate support, induce a QR scan or capture a registration secret. The account may still look normal while the attacker controls the identity, reads conversation history and continues the conversation from a trusted channel. Security needs device and registration assurance, not just a warning banner.
Q: Why do encrypted messaging apps still get targeted by phishing?
A: Because encryption protects message content, not the decision to trust a sender or approve a recovery event. Phishing wins by manipulating the identity layer around the app, including device linking, number changes and support impersonation. If that layer is weak, the attacker can own the account without breaking the cryptography.
Q: What are the signs that a social media account has been compromised or misused?
A: Warning signs include unfamiliar posts, messages sent without the user’s knowledge, login alerts from new locations, profile changes that were not approved, and contact requests that suddenly become spam or scam heavy. Organisations should treat unexplained account behaviour as a potential compromise, reset credentials quickly, revoke active sessions, and review connected third party apps for abuse.
Q: How should organisations govern sensitive communications in Signal and WhatsApp?
A: They should define when encrypted consumer messaging is allowed, what verification steps are mandatory, and how recovery or number changes are handled for high-risk users. Governance should focus on identity assurance, device control and incident escalation, because end-to-end encryption does not remove the risk of social engineering or account takeover.
Technical breakdown
How messaging account phishing works without exploiting the app
The campaign relies on social engineering rather than code exploitation. Attackers pose as platform support, a chatbot or a known contact, then push a target to reveal authentication information, scan a QR code or approve a malicious link. Because Signal and WhatsApp are tied to phone numbers and device registration workflows, the attacker does not need to break encryption to gain account control. The compromise happens when the user is induced to delegate trust to an unauthorised session or to hand over a verification secret that should never leave the device context.
Practical implication: Treat account verification and device linking as security controls, not convenience steps.
Why registration and recovery flows create a trust gap
The article highlights a subtle failure mode: once an attacker registers the account to a new phone number, the victim may re-register and see prior message history restored from the local device, which can make the takeover look like a temporary glitch. That creates a dangerous feedback loop where the user assumes continuity equals safety. In identity terms, the system is preserving data continuity while losing identity continuity. The user interface can therefore mask compromise unless linked devices, registration changes and session state are actively monitored.
Practical implication: Verify registration changes and linked-device events as security alerts, not routine account noise.
Why encryption does not neutralise impersonation risk
End-to-end encryption protects message content in transit, but it does not validate the legitimacy of the person asking for a PIN, QR scan or recovery action. That leaves a gap between transport security and identity assurance. The article also notes that Signal’s Registration Lock can still be defeated if the user volunteers personal information, which shows that technical protections are bounded by the strength of the verification process around them. In practice, the attack surface is the user decision point, not the cipher.
Practical implication: Pair encrypted messaging with explicit verification rules for recovery, support and re-registration requests.
Threat narrative
Attacker objective: The attackers want to seize trusted messaging accounts used by government sources and journalists so they can read conversations, map relationships and continue impersonation from a legitimate-looking identity.
- Entry occurs through phishing messages in Signal and WhatsApp that impersonate platform support, a chatbot or a familiar contact and induce the target to engage.
- Credential access follows when the target volunteers authentication information, scans a malicious QR code or approves a registration action that hands over account control.
- Impact is account takeover, device re-registration and exposure of message history, contacts and group context that can be used for further targeting.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Messaging platforms fail when identity assurance ends at encryption. This campaign shows that secure transport does not solve the trust problem created by support impersonation, recovery prompts and device-link workflows. Government and journalistic environments need controls that verify who is requesting re-registration, not just who can read the traffic. The practitioner conclusion is simple: protect the identity layer around messaging, not only the content layer.
Registration and recovery are the real attack surface in trusted messaging. The article’s most important signal is that attackers can win by manipulating account lifecycle events rather than finding a software flaw. That means the governance assumption that a phone-number-based account can be safely re-established by the legitimate user is too weak for high-risk users. Practitioners should treat re-registration as a privileged event that demands stronger assurance than a normal login.
Human verification remains part of identity security, even in encrypted channels. The campaign succeeds by using familiar channels and familiar-seeming requests, which makes user training a control requirement rather than an awareness slogan. Encryption, Registration Lock and modern app features are still vulnerable if users are conditioned to comply with inbound verification prompts. The field should stop describing this as a messaging problem alone and instead recognise it as identity assurance failure in a high-trust communication layer.
AI-assisted phishing will widen the gap between message plausibility and identity authenticity. Even if this campaign appears unsophisticated, the article shows how little is needed when controls rely on a human to spot inconsistencies. AI can make the lure more fluent without changing the underlying weakness. The practitioner conclusion is that verification design must outpace message realism, because authenticity checks are becoming more important than ever in everyday collaboration tools.
From our research library:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
What this signals
Messaging identity is now a governance problem, not just a user-awareness problem. Teams that protect sensitive communications need to look at registration, linked devices and recovery paths as security controls. If those events are not logged, reviewed and restricted, encrypted messaging can still become a high-trust channel for impersonation and account takeover.
Trusted-channel phishing is a better description of this risk than classic email phishing. The lure lands inside a collaboration tool where users already expect direct messages and quick responses, which raises the success rate even when the message is poorly written. That means defenders need channel-specific verification rules, not generic anti-phishing advice.
For practitioners
- Harden re-registration workflows Require stronger verification for any messaging account re-registration, especially when a number change or device transfer is requested. Treat re-registration as a privileged identity event, not a user convenience step.
- Monitor linked-device changes Alert on new linked devices, sudden session changes and repeated account recovery attempts, because those are the earliest signs of account takeover in encrypted messaging apps.
- Train users on support impersonation Update phishing training to include fake platform support, chatbot prompts, QR-code lures and requests for PINs or verification codes inside messaging apps.
- Restrict sensitive discussions in consumer messaging apps Limit classified or highly sensitive conversation handling in Signal and WhatsApp unless policy, device controls and recovery assurance are explicitly in place.
Key takeaways
- The campaign works because it targets the identity layer around encrypted messaging, not the encryption itself.
- Account re-registration, linked-device changes and support impersonation are the control points that matter most.
- For high-risk organisations, messaging governance should treat verification and recovery as privileged security events.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The campaign succeeds by abusing weak authentication and verification around messaging accounts. |
| NHI-10 — Human Use of NHI | Users are being manipulated to approve actions on accounts that should not depend on informal trust. | |
| Recommendation — Tighten authentication checks for messaging account recovery and registration events. Reduce human-approved recovery paths for high-risk messaging identities. | ||
| NIST SP 800-63 | SP 800-63B — Authentication | The article centres on authentication strength and recovery assurance in a messaging context. |
| Recommendation — Apply stronger authentication requirements to re-registration and account recovery flows. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The core threat is credential capture through phishing and social engineering. |
| Recommendation — Map the campaign to credential-access techniques and hunt for the lure patterns. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Account linking and re-registration are authorization points that need tighter governance. |
| Recommendation — Review who can approve account recovery and device linking under PR.AA-05. | ||
Key terms
- Email Account Takeover: Email account takeover is unauthorised control of a mailbox by an attacker. It is dangerous because the inbox often sits inside password reset, communication, and verification flows, allowing the attacker to impersonate the owner and extend access into other systems.
- Registration Lock: Registration Lock is a protective feature that prevents a messaging account from being re-registered without the correct protection step being completed. It reduces opportunistic takeover, but it cannot compensate for users voluntarily giving away verification information to an attacker.
- Trusted-Channel Phishing: Trusted-channel phishing is social engineering that uses a collaboration or messaging channel the target already relies on and expects to be legitimate. Because the channel itself feels routine, the attacker can make malicious requests appear operationally normal, which increases the chance of user compliance.
- Linked-Device Control: Linked-device control is the governance of which devices are authorised to access a messaging account and what events trigger alerts or revocation. In high-risk environments, linked-device changes are security events because they often mark the boundary between legitimate use and account compromise.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle and secrets management for practitioners who need stronger control over trusted accounts and recovery paths. It gives security teams a practical way to connect identity governance with the controls that protect high-risk communications.
Published by the NHIMG editorial team on July 14, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org