This page adapts the habits from our pillar page Digital Hygiene to a work context. Every technical claim is sourced; the full list is on the Sources page.
Check the 'linked devices' on the messaging app you use for work
WhatsApp, Telegram and Signal all let you connect a computer to an account using a QR code — useful for a team, but a device linked without the account holder's knowledge reads work messages continuously, with no warning from the app. On WhatsApp: Settings → Linked Devices. On Telegram: Settings → Devices. On Signal: Settings → Linked Devices. A monthly check is enough for an active work line.
NCSC (National Cyber Security Centre, part of GCHQ), 'NCSC warns of messaging app targeting', 31 March 2026 (recommended action: regularly audit linked devices) · WhatsApp Help Centre, Telegram FAQ, Signal Support.A messaging QR code scanned 'to join a group' can hijack the account
The NCSC documented in an alert dated 31 March 2026 phishing carried out via a malicious link or QR code, alongside the unauthorised addition of a linked device to a messaging account — without the victim ever noticing. Contacts the victim already knows are impersonated to help draw them in. The alert describes those targeted as 'high-risk individuals' — government officials and similar — and attributes the campaign to what it calls 'Russia-based actors'. The documented targets are government and military, but the mechanism doesn't distinguish a private-sector executive from a public official: it targets the account, not the employer.
NCSC (National Cyber Security Centre, part of GCHQ), 'NCSC warns of messaging app targeting', 31 March 2026.No messaging 'support' account ever asks for a code by message
A code sent to 'confirm your identity' or 'reactivate an account' is exactly what authorises a new device. The same NCSC alert lists the sharing of recovery and login codes among the mechanisms behind this campaign. A colleague who receives this kind of request — even one signed with an executive's name — should verify through a separate channel before responding.
NCSC, 'NCSC warns of messaging app targeting', 31 March 2026 (describes shared recovery/login codes as part of the campaign).Keep the work line separate from the personal line, on the same phone
A work line that's widely published (a website, B2B platforms, hiring forms) is mechanically more exposed to cold calls and to fraud attempts targeting businesses than a personal line kept for family and friends. A dual SIM phone (two cards, or a card plus an eSIM) keeps the two separate without carrying two devices.
Turn on an extra lock, and two-factor authentication on sensitive accounts
The NCSC's own alert recommends turning on two-factor authentication or a passkey wherever it's available, alongside regularly auditing which devices are linked to an account — Signal and WhatsApp both offer an in-app lock of this kind. On sensitive work accounts (company email, cloud tools, banking), two-factor authentication remains the strongest first line of defence against a stolen or reused password.
NCSC, 'NCSC warns of messaging app targeting', 31 March 2026 (recommended actions: two-factor authentication or passkeys where available; regular audit of linked devices).What Egidio already does for your team, continuously
The habits above take human action. Two features exist for the rest — the messages that arrive without warning, or the ones a colleague is unsure about.
Upfront scanning of the work messaging app Premium
WhatsApp, Telegram, Messenger, and more than 183 messaging apps are scanned automatically, with nothing to configure.
A second opinion on a specific message Premium
A message that makes a colleague uneasy, received on a channel Egidio doesn't natively monitor? Share it to Egidio (the phone's Share menu) for a second opinion, with the explanation.
An executive doesn't need to be a high-risk target to be exposed: using WhatsApp or Signal for work is enough. The same habits that apply to any personal account apply here — with one more work line to protect.
Frequently asked questions
Is a small business really affected by this kind of targeting?
The NCSC's alert describes 'high-risk individuals' — government officials and similar — as the documented targets. But the technical mechanism (a hijacked messaging QR code, a shared login code) makes no distinction by company size: it works against any WhatsApp, Signal, or Telegram account used for work, including a freelancer's or a small business's.
Do I need a dedicated security tool for a work line?
The habits on this page (linked devices, QR codes, verification codes) cost nothing and cover the essentials. A tool like Egidio adds an automatic layer — messaging analysis and fraud call blocking — for the cases where vigilance alone isn't enough.