AIVD
Dutch General Intelligence and Security Service, which co-issued the joint advisory warning of state-linked QR-code attacks on Signal and WhatsApp.
The AIVD joined Britain's NCSC and the FBI on 15 September 2026 in exposing CHOSEN BRICK, Windows spyware they attribute to Iranian state actors targeting dissidents and journalists, the latest in a run of joint attributions by the Dutch service this year.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Why are Dutch and UK intelligence agencies jointly warning about Signal QR codes?
Timeline for AIVD
Mentioned in: Star Blizzard lures think tanks by invite
Cybersecurity: Threats and DefencesCo-published the CHOSEN BRICK exposure
Cybersecurity: Threats and Defences: UK, US and Dutch expose Iranian spywareCo-sealed the AA26-204A advisory
Cybersecurity: Threats and Defences: Zimbra preview leaks mail to RussiaSigned 16-agency joint advisory on China-nexus covert networks
Cybersecurity: Threats and Defences: Sixteen cyber agencies name Flax Typhoon networkMentioned in: NCSC ships SilentGlass, its first commercial product
Cybersecurity: Threats and DefencesBackground
The AIVD (Algemene Inlichtingen- en Veiligheidsdienst) is the Netherlands' General Intelligence and Security Service, responsible for counterintelligence, counterterrorism and cyber threat assessment. It publishes threat advisories with European and Five Eyes partners and has made a speciality of naming Russian, Chinese and Iranian state actors in public.
Its 2026 record shows the pattern. On 9 March it warned with the UK NCSC that Russia's FSB Star Blizzard, China's APT31 and Iran's IRGC were using malicious QR codes and contact impersonation to take over Signal, WhatsApp and Messenger accounts of politicians, journalists, academics and lawyers; both agencies urged passkeys and a linked-devices audit. On 23 April it was among 16 agencies naming Flax Typhoon and Integrity Technology Group behind more than 200,000 hijacked home routers.
On 23 July the AIVD was one of 15 signatories of advisory AA26-204A, which named Russian state-backed LAUNDRY BEAR behind a zero-click Zimbra webmail exploit. The Dutch services first identified and attributed that group in 2025; Microsoft tracks it as Void Blizzard. On 15 September it co-published the CHOSEN BRICK exposure with the NCSC and FBI.