Portugal Intelligence Agency Warns of Global Campaign Targeting WhatsApp and Signal Accounts

Foreign state-backed hackers are carrying out a global cyber campaign aimed at gaining access to the messaging accounts of government officials, diplomats and military personnel, Portugal’s intelligence service has warned.

The alert was issued by Serviço de Informações de Segurança (SIS), which said attackers are attempting to trick users of encrypted messaging platforms into revealing sensitive information such as passwords.

According to SIS, the campaign targets individuals with access to sensitive or privileged information, including government officials, diplomats, members of the military and civil society actors in Portugal and allied countries.

The attackers are focusing on users of WhatsApp and Signal, two platforms widely used by officials, business executives and security personnel for secure communication.

SIS said the hackers are exploiting the assumption that end-to-end encryption alone guarantees security. By manipulating users into sharing login credentials or other sensitive data, attackers can gain access to personal and group conversations as well as shared files.

The agency stressed that the campaign does not necessarily indicate that the messaging platforms themselves have been compromised, but instead appears to rely on social engineering techniques targeting individual users.

Authorities did not identify the country behind the campaign.

However, intelligence agencies in the Netherlands recently warned that hackers linked to Russia had launched a similar global operation aimed at accessing accounts on the same messaging platforms.

Portugal’s intelligence service said it released the advisory not only to alert government personnel but also to encourage broader public awareness and preparedness against potential cyberattacks targeting widely used communication services.