When a Friendly DM Is Part of a Targeted Campaign

For a journalist, activist or researcher, a message from a new source is part of the work. It might arrive on a social platform, a messaging app or an email account. The sender may sound informed and generous. They may offer an interview, a document, a contact or a chance to clarify a story. That ordinary openness is not a flaw; it is often how reporting and civic work happen.

A joint advisory published on September 15, 2026 by the United Kingdom’s National Cyber Security Centre, the FBI and the Netherlands’ AIVD warned of cyber targeting directed at dissidents, activists and journalists. The advisory describes approaches through social platforms and messaging services in which an actor may pose as a trusted person or helpful contact and steer the conversation toward a risky interaction or file. The agencies’ warning is not a reason to assume every new contact is hostile. It is a reason to recognize that the social layer—who is speaking, why now, and what they want you to do—can be part of the attack surface.

That distinction is especially important for people whose work depends on being reachable. “Be suspicious of everyone” is not a workable security policy. It isolates the very people who need sources and colleagues. Better protection creates a few repeatable checks around the moments when a conversation changes channel, asks for sensitive information or introduces an unexpected download.

The relationship can be the lure

A targeted message does not have to look like a mass phishing email. It may use the vocabulary of the recipient’s profession or refer to a public event, article or organization. The first interaction may be pleasant and unremarkable. The risk can emerge later: the conversation is moved to a new app, the sender asks for a document to be opened, a source requests a private call, or an invitation arrives with a file the recipient did not expect.

The presence of familiar details is not proof of a relationship. Public biographies, past interviews, event listings and social posts can provide context to someone who has never met the target. A profile photo can be copied. A colleague’s account can be compromised. And an authentic message from a real contact can still carry a malicious request if the account has been taken over.

For this reason, identity checks should be proportionate to the request, not to the sender’s charm. A low-risk exchange about a public article may need no special ceremony. A request to share unpublished documents, reveal a source, change a payment route, install software or disclose a recovery code deserves a separate check.

Do not ask, “Could this person plausibly know me?” Ask, “Is this request consistent with how we normally work, and can I confirm it through another route?”

A field checklist that keeps the work moving

Moment	Low-friction check	When to slow down
A new source makes contact	Keep the conversation on the platform initially; ask how they found you and what they want to discuss.	The person immediately asks for secrecy, sensitive personal data or a move to an unfamiliar channel.
A familiar contact sends a file or urgent request	Confirm using a known work address, saved number or previously established contact route.	The message is out of character, unusually urgent or tied to a security reset or payment.
You need to open a document	Ask for the context and expected file type; use your organization’s approved tools and device.	The sender asks you to disable a safeguard, install a viewer or enter credentials after opening it.
You may share unpublished or sensitive material	Use an agreed secure channel and check that the recipient is authorized to receive it.	The request bypasses editorial, legal or source-protection procedures.

Protect the accounts that protect the work

Journalists and advocates often maintain several public-facing accounts. The goal is not to hide all professional information; it is to make it harder for one compromised account to unlock the others. Use a unique password for each important account and phishing-resistant multifactor authentication where the service supports it. A passkey or security key can reduce the chance that a fake sign-in page captures a reusable password, though it does not validate the social request surrounding the login.

Review recovery email addresses, phone numbers and active sessions for accounts that control publication, cloud storage and messaging. Secure the primary email first, because it can often reset other accounts. Keep a separate recovery method that is not displayed publicly. Do not share one-time codes with a caller or DM sender, even if they claim to be support. Our explainer on unexpected multifactor prompts covers why an authentication notification can be genuine while the story used to explain it is not.

For small newsrooms and advocacy groups, practical defenses can be shared. Maintain a list of official support contacts; decide who can approve changes to payment details or account recovery; and give staff a simple way to report a suspicious contact without publicly naming a source. A person should be able to say “this request feels wrong” without proving that it is malicious first.

Source protection includes emotional safety

Security advice can inadvertently shift responsibility onto the person being targeted. A public profile, a busy inbox or a willingness to engage with sources is not consent to harassment, and no checklist can guarantee that a determined actor will not imitate a contact. Organizations have a role: make reporting confidential, respond without blame, and help affected staff secure accounts and devices.

When a conversation feels wrong, preserve the message and the account details if it is safe to do so. Avoid confronting the sender or publicly accusing a named person before you have checked whether their account may be compromised. Report platform abuse through the platform’s official process and, where a credible threat exists, contact the appropriate organization or law-enforcement channel. For high-risk work, follow guidance from your employer, union, newsroom security lead or a specialist digital-safety organization.

If you already clicked, entered credentials or opened a file, tell the right support person promptly. Disconnecting a device, changing passwords or deleting evidence can have different consequences depending on the incident, so use the organization’s incident-response advice rather than improvising. The most helpful first report is plain: what happened, when, what you clicked or shared, and what account or device was involved.

Trust is not the opposite of security

Trust is how professional relationships function; verification is how they stay resilient under pressure. The September advisory is most useful when it prompts teams to notice channel changes, strengthen account recovery and rehearse low-drama identity checks—not when it encourages a general climate of suspicion. A source should not have to pass a puzzle to be heard, and a reporter should not have to decide alone whether a compelling story is safe.

Build a routine that leaves room for human judgment: a known call-back route, a second person for unusual high-impact requests, and an approved method for handling sensitive documents. Then apply that routine consistently, including when the sender is familiar and the timing feels urgent. A respectful pause protects both the relationship and the work.

Sources

• UK NCSC, “Iranian cyber targeting of dissidents, activists and journalists,” September 15, 2026.
• UK NCSC device-security guidance for individuals and organizations.