The WhatsApp accounts of a federal parliamentarian and three staffers were hacked by a presumed foreign state actor, a budget estimates hearing has been told.
The Department of Parliamentary Services blocked the Meta-owned messaging application on all parliamentary web browsers after the phishing attack was reported on March 6, the department's chief information officer Mike Webb told an inquiry on Monday.
All four accounts were compromised in the same way, Mr Webb said.
The hackers first requested a legitimate verification code be sent to the users' devices.
They then sent the victims a request to send them the verification code, which the hackers used to log into the account.
"The next step is to link one of their devices, and they essentially become that person from a communication perspective," Mr Webb said.
