Australian MP, staffers hacked in WhatsApp attack by ‘foreign actor’
How the WhatsApp Hack Unfolded
In a targeted phishing attack on March 6, 2026, an Australian federal parliamentarian and three staffers had their personal WhatsApp accounts compromised. The attackers used a simple yet effective method: they first triggered legitimate verification codes to the victims' devices, then contacted the victims posing as trusted contacts asking for those codes. Once handed over, the hackers linked the accounts to their own devices, effectively gaining full communication control. The breach was confirmed during a Senate Estimates hearing on May 25, where Department of Parliamentary Services (DPS) officials detailed the incident's progression.
DPS Chief Information Officer Mike Webb explained that the attack pattern indicated a coordinated effort by a foreign state actor. The compromised accounts were personal but were also accessed on DPS-managed devices, raising alarm about cross-platform vulnerabilities. The attackers' objective was account takeover, which they successfully achieved in all four cases. DPS immediately notified the Australian Signals Directorate (ASD) and temporarily blocked WhatsApp web access on the parliamentary network from March 9 to March 16 to contain potential spread.
Phishing Tactics and Social Engineering
The attack relied heavily on social engineering rather than sophisticated technical exploits. Phishing remains one of the most effective cyber threats because it targets human psychology. The hackers masqueraded as trusted contacts—potentially even other parliamentarians whose accounts were already compromised—to request the verification code. This trust-based approach made victims more likely to comply. Once the attacker entered the code, WhatsApp automatically linked their device, giving them full access to messages, media, and contact lists.
Similar Warnings from Global Agencies
This method mirrors tactics warned about by cybersecurity agencies worldwide. In 2025, the UK's National Cyber Security Centre and the US Cybersecurity and Infrastructure Security Agency issued advisories detailing identical phishing techniques targeting WhatsApp users. The Australian attack suggests these threat actors have become more aggressive, specifically targeting high-value political figures. The DPS official noted that the attackers appeared to have prior knowledge of the victims' networks, making the phishing messages highly convincing.
Response and Mitigation Steps
Upon discovering the breach, DPS acted swiftly to isolate the threat. They blocked WhatsApp web browsers on the parliamentary network—a move that disrupted workflow but prevented further account compromises. The affected individuals received immediate support, and ASD conducted a forensic investigation. Post-incident, DPS urged all parliamentarians and staff to review their security settings, enable two-factor authentication, and be cautious when sharing verification codes or sensitive information through messaging apps.
Broader Cyber Threat Landscape
This incident is part of a larger pattern of cyberattacks targeting Australian government entities. Between July 2025 and March 2026, DPS detected 46 malware incidents, nearly 20,000 phishing attempts, and 1,458 cyber alerts. The sheer volume underscores the persistent threat facing political offices. Officials emphasized that while messaging apps like WhatsApp offer convenience, they were not designed for highly sensitive communications. The breach reinforces the need for robust cybersecurity protocols and ongoing staff training.
Lessons for Political Offices
The hacking incident highlights critical vulnerabilities in personal device usage within secure environments. Political figures and their staff must adopt a security-first mindset, treating every unexpected request for verification codes with suspicion. Implementing phishing-resistant authentication methods, such as hardware security keys, can add an extra layer of protection. Regular cybersecurity drills can help staff recognize and report phishing attempts before they succeed. As threats evolve, continuous adaptation and vigilance remain the best defense, ensuring that even the most trusted communication channels don't become gateways for foreign adversaries.