AIVD

AIVD co-issued a joint advisory with the UK NCSC on 9 March 2026 warning that state-linked actors, including Russia's FSB Star Blizzard, China's APT31 and Iran's IRGC, are using malicious QR codes and contact impersonation to compromise Signal, WhatsApp and Facebook Messenger accounts of politicians, journalists, academics and lawyers. Both agencies recommended passkeys and a device audit as mitigations. AIVD was among the 15 signatories of joint advisory AA26-204A on 23 July 2026, which named Russian state-supported actor LAUNDRY BEAR behind a zero-click exploit chain against Zimbra Collaboration Suite webmail, the same group AIVD first identified and attributed in 2025 under the codename Void Blizzard.

AIVD, the Algemene Inlichtingen- en Veiligheidsdienst, is the Netherlands' domestic intelligence and security service responsible for counterintelligence, counterterrorism and cyber threat assessment. It publishes threat advisories in coordination with European and Five Eyes partners and has been particularly active on Russian and Chinese state actor attribution in recent years.

The joint NCSC-AIVD advisory is notable as a coordinated European counterintelligence response to a cross-border messaging-platform campaign rather than a national-level advisory. For Dutch and UK civil-society targets in the advisory's scope, the message from both agencies is that passkey adoption is now a state-security recommendation, not a convenience feature.