Germany suspects Russia behind Signal phishing attacks on officials

Germany suspects Russia orchestrated a phishing campaign that compromised roughly 300 Signal accounts belonging to senior government officials, military personnel and journalists, Der Spiegel reported Sunday.

The suspected espionage operation — which German federal prosecutors are now investigating — illustrates how end-to-end encrypted apps can be hijacked without breaking their encryption, simply by deceiving users into linking accounts to attacker-controlled devices. The attack is part of a broader surge in Russian cyberattacks targeting European governments since Moscow's full-scale invasion of Ukraine in 2022.

Attackers posed as Signal security chatbots and sent messages warning of suspicious account activity, urging users to act immediately. Those who followed the instructions by entering their PIN or scanning a QR code unknowingly authorized an attacker-controlled external device to link to their account — granting the hackers access to past conversations, ongoing chats, address books and stored user data, Der Spiegel reported.

Germany's Federal Office for the Protection of the Constitution, the BfV, and the Federal Office for Information Security, the BSI, issued a public warning in February, saying the intrusions were "likely being carried out by a state-controlled cyber actor," according to the German press agency dpa. Neither agency officially attributed the campaign to Russia by name, but German authorities told Der Spiegel they suspect Russian involvement.

Dutch intelligence and security services broadened the picture in March, warning that "Russian state hackers are engaged in a large-scale global cyber campaign to gain access to Signal and WhatsApp accounts belonging to dignitaries, military personnel and civil servants."

Among the roughly 300 compromised accounts were two government ministers, according to Der Spiegel. German federal prosecutors have opened a preliminary espionage inquiry into the attacks. Russia's Foreign Ministry summoned Alexander Graf Lambsdorff, Germany's ambassador to Russia, over the allegations. Lambsdorff said he would comply with the summons, but added: "I consider it unlikely that the Russian side will be able to substantiate its accusations."

The Russian Embassy denied any involvement. Moscow has repeatedly rejected Western accusations of state-sponsored hacking operations.

Germany's BfV and BSI have advised all Signal users to review their list of linked devices and activate two-step verification as protection against similar intrusions.