The NCSC warns of attacks on WhatsApp and Signal accounts: check your linked devices today
Russia-linked groups are taking over messaging accounts by tricking people, not by breaking encryption. Five minutes of checks will protect yours.
By OwnYourStack Admin · Published
The National Cyber Security Centre warned in March 2026, and updated its advice in July with an infographic, that Russia-based actors are increasingly targeting people through messaging apps such as WhatsApp and Signal. The warning is aimed at high-risk individuals, meaning people in politics, journalism, government and similar roles, but the techniques are the same ones used in ordinary account-takeover scams. Anyone can be caught.
The attackers are not breaking the encryption
The apps' encryption is sound. What gets attacked is you and your account settings. The NCSC describes these methods:
- tricking you into sharing a login or account-recovery code;
- quietly adding the attacker's device to your account as a linked device;
- joining group chats unnoticed;
- impersonating someone you know; and
- phishing through malicious links or QR codes.
The linked-devices trick is particularly nasty because the attacker gets a live copy of your conversations and you may never see an alert.
A five-minute checklist
- Turn on two-step verification. In WhatsApp it is under Settings, Account, Two-step verification. In Signal it is called Registration Lock. Choose a PIN you do not use elsewhere.
- Check linked devices. In WhatsApp, open Linked devices; in Signal, Linked devices. Remove anything you do not recognise, and revisit the list monthly.
- Never share a verification code, even with a contact who asks urgently. Their account may already be compromised.
- Do not scan unexpected QR codes sent in a chat, email or text.
- Enable passkeys wherever the app or your phone account offers them. Our passkeys guide explains how.
- Review your group members. Remove unknown numbers, and be suspicious of a contact who appears twice.
- Consider disappearing messages for sensitive personal chats.
Verify the person, not the message
If a friend suddenly asks for money, a code or a favour, call them on a number you already have. Impersonation works because the message looks and feels right.
If you think you have been compromised
Log out all linked devices, re-register the app on your phone to force a fresh session, set a new two-step PIN, warn your contacts from a different channel, and change the password of the email account tied to your phone number. People who work in high-risk roles should read the NCSC's guidance for high-risk individuals, which includes its Individual Cyber Defence services.
The NCSC also advises not sharing sensitive work information over consumer messaging apps at all, and following your employer's policy on approved channels.
