An internal European cybersecurity warning says state-linked attackers are increasingly exploiting trusted messaging apps and highly tailored social-engineering lures to reach diplomats, policymakers and other senior figures.
State-backed hackers have targeted senior European Union officials through WhatsApp and other encrypted messaging platforms, according to an internal cyber warning that underscores a growing shift in espionage operations away from traditional email and toward the personal communications channels used by policymakers.
The warning, reported on Tuesday by POLITICO and attributed to the EU’s internal cybersecurity service, CERT-EU, describes campaigns in which sophisticated attackers tailor messages specifically to high-ranking officials, seeking to persuade them to interact with malicious content or surrender access to their accounts.
The activity is part of a broader pattern increasingly visible across Europe: rather than attempting to defeat the encryption protecting services such as WhatsApp or Signal, cyber operators are targeting the people using them.
That distinction is critical. End-to-end encryption can make intercepted communications extremely difficult to read, but it cannot prevent a user from being deceived into authorising a new device, revealing a verification code or following instructions presented by an attacker impersonating a trusted contact.
European intelligence services have already warned that this approach is being used at scale. In March, Dutch intelligence agencies AIVD and MIVD said Russian state-sponsored hackers were running a global campaign aimed at gaining access to WhatsApp and Signal accounts belonging to government officials, military personnel and journalists. The agencies assessed that sensitive information had probably already been compromised.
The attackers were not believed to have broken the encryption used by the messaging platforms themselves. Instead, they relied heavily on social engineering, including fake support messages designed to convince victims to provide security credentials or register attacker-controlled devices.
CERT-EU has separately documented similar activity across Europe. Its February 2026 cyber brief highlighted a sophisticated phishing campaign impersonating Signal’s support service and targeting politicians, military personnel and journalists. German authorities suspected that campaign was state-sponsored.
The growing use of messaging applications represents an important tactical evolution for cyber-espionage groups.
For years, senior officials have been trained to recognise suspicious emails, unexpected attachments and unusual login pages. Government networks also deploy increasingly sophisticated filtering, malware scanning and endpoint monitoring systems. WhatsApp and Signal, by contrast, occupy a more personal and immediate communications environment, where an unexpected message from a colleague, aide or supposed support representative may appear more credible.
A carefully prepared lure can exploit that familiarity.
Attackers researching a senior political figure can identify professional relationships, upcoming meetings, diplomatic events or policy discussions and use those details to make a malicious message appear legitimate. A message ostensibly sent by another official may ask the recipient to join a secure discussion group, review a document or verify an account.
Once the victim follows the instructions, the attacker may attempt to register an additional device or session associated with the account. Depending on the technique used, that can potentially expose conversations, shared files and contact networks.
Such access would be particularly valuable for a foreign intelligence service.
Senior EU officials routinely discuss sanctions, defence policy, negotiations, diplomatic positions and preparations for European Council meetings before those decisions become public. Even fragments of private conversations can give an adversary insight into disagreements between governments, negotiating red lines or the positions individual countries intend to take.
The intelligence value therefore extends far beyond the compromised individual.
An attacker gaining access to one senior official’s messaging account may also acquire information about colleagues, advisers, military officials and foreign counterparts. Those contacts can subsequently become targets themselves, allowing the operation to expand through trusted professional networks.
This makes account takeover especially useful for espionage campaigns built around impersonation. Once an attacker controls a genuine account, subsequent messages sent to the victim’s contacts may carry considerably greater credibility than conventional phishing attempts.
Europe’s security agencies have become increasingly concerned about precisely this type of targeting.
In July, the European Union publicly accused Russia of operating a broad malicious cyber ecosystem involving state intelligence agencies, criminal infrastructure, private companies and other proxies. The EU specifically identified Russia’s Federal Security Service, or FSB, as directing cyber groups responsible for espionage against European governmental and strategic targets.
The bloc subsequently imposed its largest cyber-sanctions package to date, targeting individuals and organisations accused of supporting malicious Russian cyber operations against European governments, public services and critical infrastructure.
China-linked operations remain another major concern. In March, the EU sanctioned two Chinese technology companies and their founders over cyber operations affecting European countries. The Council said China-based Integrity Technology Group had supported compromises affecting more than 65,000 devices across six EU member states, while Anxun Information Technology had provided hacking services targeting critical infrastructure and government functions.
The latest warning does not, however, mean every WhatsApp campaign targeting EU officials can be attributed to Russia or China. Cyber attribution remains technically and politically difficult, and multiple intelligence services, commercial surveillance operators and criminal groups can use similar techniques.
For defenders, the more immediate lesson is that increasingly sophisticated cyber operations are exploiting identity rather than software.
A senior official with a fully patched smartphone and encrypted communications may still be vulnerable if an attacker can convincingly impersonate a colleague or platform administrator. In such attacks, the decisive vulnerability is often not a previously unknown software flaw but the trust relationship surrounding the target.
The campaigns also demonstrate why personal devices and unofficial communications platforms have become an increasingly important part of government cybersecurity.
Political and diplomatic work rarely remains confined to institutional computers. Officials communicate while travelling, participate in informal messaging groups and maintain conversations with external contacts across multiple platforms. Those habits create an environment where the boundary between government communications and personal digital life becomes increasingly difficult to defend.
For foreign intelligence services, that boundary is an opportunity.
Instead of attacking a hardened EU network directly, an adversary may find it easier to compromise an individual account belonging to someone who already has access to valuable information.
The strategy is less technically dramatic than exploiting a sophisticated zero-day vulnerability, but potentially just as effective.
And as European institutions strengthen their networks against conventional cyberattacks, the battle for access is increasingly moving to the devices carried in officials’ pockets — and to the messages they instinctively trust.
