Germany Investigates Signal Phishing Targeting Officials, Suspects Russian Role
Summary
German prosecutors are investigating phishing attacks targeting Signal accounts. The government suspects Russia but has not officially attributed the campaign; Der Spiegel reported about 300 accounts were compromised.
Key points
- German prosecutors opened a preliminary investigation in mid-February 2026, including an initial suspicion of espionage.
- The German government suspects Russia, but has not officially attributed the attacks; Russia denies spying on other countries.
- Der Spiegel, citing government sources, reported about 300 Signal accounts were compromised; victims' names have not been officially confirmed.
- The reported phishing messages impersonated a Signal security chatbot and urged users to enter a PIN or scan a QR code, which could link their accounts to an attacker-controlled device.
- Germany's BfV and BSI warned in February of a campaign likely conducted by a state-controlled cyber actor; Dutch services later warned of a campaign targeting Signal and WhatsApp accounts.
Article Details
- Event Type
- Phishing campaign targeting Signal accounts, with German authorities investigating alleged cyberattacks and the government suspecting Russian involvement; attribution has not been officially confirmed.
- Impact
- Der Spiegel reported, citing governmental sources, that around 300 accounts belonging to people in Germany’s political sphere were compromised. The attackers could reportedly access past and ongoing conversations, address books, and other user data. German authorities also warned of similar targeting of government employees, dignitaries, military personnel, civil servants, and possibly journalists in Germany and the Netherlands.
MITRE ATT&CK
Products
SignalThe German government suspects Russia is behind a series of phishing attacks on Signal targeting high-ranking politicians, including two government ministers, military personnel and journalists, a governmentWhatsApp“Russian state hackers are engaged in a large-scale global cyber campaign to gain access to Signal and WhatsApp accounts belonging to dignitaries, military personnel and civil servants.”
Countries
GermanyGermany and other European countries have been under increased pressure from cyberattacks and other malign activity linked to Russia by Western officials since Moscow’s full-scale invasion of Ukraine in February 2022.RussiaThe German government suspects Russia is behind a series of phishing attacks on Signal targeting high-ranking politicians, including two government ministers, military personnel and journalists, a government
Industries
GovernmentThe German government suspects Russia is behind a series of phishing attacks on Signal targeting high-ranking politicians, including two government ministers, military personnel and journalists, a governmentMediaNo connection has been made between the summons and the German media revelations about the Signal phishing attacks.