Topic starter
14/07/2026 6:05 pm
TL;DR: A state-backed phishing campaign is targeting government sources and journalists through Signal and WhatsApp by abusing trust, direct-message prompts, and account re-registration rather than technical exploits, according to Swarmnetics and the Dutch Ministry of Defence. The pattern shows that messaging security still depends on user verification and account recovery controls, not encryption alone.
Editorial analysis by NHI Mgmt Group, based on content published by Swarmnetics: “Signal & WhatsApp Phishing Campaign by Russian Spies Targets Government Sources and Journalists”.
Key questions
Q: What breaks when messaging apps rely on user verification alone?
A: User verification alone breaks when attackers can impersonate support, induce a QR scan or capture a registration secret.
Q: Why do encrypted messaging apps still get targeted by phishing?
A: Because encryption protects message content, not the decision to trust a sender or approve a recovery event.
Q: What are the signs that a social media account has been compromised or misused?
A: Warning signs include unfamiliar posts, messages sent without the user’s knowledge, login alerts from new locations, profile changes that were not approved, and contact requests that suddenly become spam or scam heavy.
Practitioner guidance
- Harden re-registration workflows Require stronger verification for any messaging account re-registration, especially when a number change or device transfer is requested.
- Monitor linked-device changes Alert on new linked devices, sudden session changes and repeated account recovery attempts, because those are the earliest signs of account takeover in encrypted messaging apps.
- Train users on support impersonation Update phishing training to include fake platform support, chatbot prompts, QR-code lures and requests for PINs or verification codes inside messaging apps.
Bottom line: The campaign works because it targets the identity layer around encrypted messaging, not the encryption itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 6:11 pm
Messaging platforms fail when identity assurance ends at encryption. This campaign shows that secure transport does not solve the trust problem created by support impersonation, recovery prompts and device-link workflows. Government and journalistic environments need controls that verify who is requesting re-registration, not just who can read the traffic. The practitioner conclusion is simple: protect the identity layer around messaging, not only the content layer.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: How should organisations govern sensitive communications in Signal and WhatsApp?
A: They should define when encrypted consumer messaging is allowed, what verification steps are mandatory, and how recovery or number changes are handled for high-risk users. Governance should focus on identity assurance, device control and incident escalation, because end-to-end encryption does not remove the risk of social engineering or account takeover.
👉 Read our full editorial: Signal and WhatsApp phishing exposes trust gaps in government messaging