German authorities suspect a state-linked campaign, likely tied to Russia, targeted Signal accounts belonging to senior politicians, ministers, military personnel and journalists. Federal prosecutors opened a preliminary investigation in mid-February 2026 that includes an initial espionage suspicion, though no formal attribution has been made. Reporting indicates about 300 accounts were compromised after victims followed instructions from a fake Signal security chatbot that paired accounts with attacker-controlled devices. German and Dutch security agencies warned the campaign appeared to be state-directed.
Germany Suspects Russian State Hackers Behind Signal Phishing Campaign Targeting Top Officials
FILE - Signal app on a smartphone is seen on a mobile device screen Tuesday, March 25, 2025, in Chicago. (AP Photo/Kiichiro Sato, File)(ASSOCIATED PRESS)
German authorities suspect Russia is behind a coordinated phishing campaign that targeted Signal accounts belonging to senior politicians, two government ministers, military personnel and journalists, a government spokesperson said.
Federal prosecutors opened a preliminary investigation in mid-February 2026 into the alleged cyberattacks, the prosecutors' office confirmed. The probe includes an initial suspicion of espionage, though the government has not yet made a formal attribution to any specific country.
How The Attack Worked
According to reporting by Der Spiegel, roughly 300 Signal accounts connected to people in the political sphere were compromised. Victims were contacted by a fake Signal security chatbot that warned of suspicious activity and urged immediate action. If users followed the instructions — for example by entering a PIN or scanning a QR code — their Signal accounts could be paired with an external device controlled by the attackers.
That pairing reportedly gave attackers access to past conversations, ongoing chats, address books and other data stored within the accounts.
Warnings From German And Dutch Agencies
In February, Germany's domestic intelligence service (BfV) and the federal cybersecurity agency (BSI) issued a public alert about this type of phishing operation, saying it was "likely being carried out by a state-controlled cyber actor." German authorities also personally warned several politicians they may have been targeted, the German press agency dpa reported.
In March, Dutch intelligence and security services warned that "Russian state hackers are engaged in a large-scale global cyber campaign to gain access to Signal and WhatsApp accounts belonging to dignitaries, military personnel and civil servants." Dutch officials said the campaign included attempts against government employees and possibly journalists.
Official Responses
The Russian embassy in Berlin did not respond to an AP request for comment. Moscow has repeatedly denied spying on other countries.
Separately, Alexander Graf Lambsdorff, Germany's ambassador to Russia, was summoned to the Russian Foreign Ministry in connection with alleged contacts between German politicians and terrorist organizations. German officials say there is no confirmed link between that summons and the media coverage of the Signal phishing attacks. "I will, of course, comply with the summons. I consider it unlikely that the Russian side will be able to substantiate its accusations," Lambsdorff said.
The investigation is ongoing and German authorities have not publicly released the names of affected users.
Note: The situation highlights growing concerns among Western governments about state-linked cyber operations targeting secure messaging apps.
Help us improve.
