AIVD

AIVD co-issued a joint advisory with the UK NCSC on 9 March 2026 warning that state-linked actors, including Russia's FSB Star Blizzard, China's APT31 and Iran's IRGC, are using malicious QR codes and contact impersonation to compromise Signal, WhatsApp and Facebook Messenger accounts of politicians, journalists, academics and lawyers. Both agencies recommended passkeys and a device audit as mitigations.

AIVD, the Algemene Inlichtingen- en Veiligheidsdienst, is the Netherlands' domestic intelligence and security service responsible for counterintelligence, counterterrorism and cyber threat assessment. It publishes threat advisories in coordination with European and Five Eyes partners and has been particularly active on Russian and Chinese state actor attribution in recent years.

The joint NCSC-AIVD advisory is notable as a coordinated European counterintelligence response to a cross-border messaging-platform campaign rather than a national-level advisory. For Dutch and UK civil-society targets in the advisory's scope, the message from both agencies is that passkey adoption is now a state-security recommendation, not a convenience feature.