Threat reportPhishingTL-2026-3767
Suspected state-sponsored Signal phishing campaign (fake Signal Support chatbot, PIN/verification-code theft and linked-device abuse) targeting politicians, military, diplomats and journalists in Germany and Europe
Suspected state-sponsored Signal phishing campaign (fake (TL-2026-3767), also tracked as Signal Security ChatBot phishing, is a high-severity phishing campaign, first published 2026-10-16. It has no confirmed attribution, affects Signal Foundation Signal Messenger (user accounts; no software, maps to 8 MITRE ATT&CK techniques (T1078, T1098.005, T1111), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-3767
- Threat ID
- TL-2026-3767
- Also known as
- Signal Security ChatBot phishing, Signal linked-device phishing
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- ESPIONAGE
- Target sectors
- government administration, military, diplomacy, news - media
- Target regions
- germany, Europe
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in Suspected state-sponsored Signal phishing campaign (fake
Malware and tooling: GhostPairing
How Suspected state-sponsored Signal phishing campaign (fake works
Germany's BfV and BSI warned of a likely state-controlled actor impersonating 'Signal Support' / 'Signal Security ChatBot' to trick high-profile targets into disclosing Signal PINs or SMS verification codes, or into scanning a QR code that links an attacker-controlled device. No malware or Signal vulnerability is involved; legitimate account features are abused to take over accounts or covertly read messages and contacts.
On 2026-02-06 the German Federal Office for the Protection of the Constitution (BfV) and Federal Office for Information Security (BSI) issued a joint warning about a phishing campaign on Signal run by a presumably state-controlled actor. Reported targets are high-ranking individuals from politics, the military and diplomacy, plus investigative journalists in Germany and Europe. The authorities state that, given the target set, known cases are likely attributable to a state-controlled cyber actor; no country or group is named.
Two variants are described. In variant 1 (account takeover), the victim receives a Signal message from an account posing as 'Signal Support' or 'Signal Security ChatBot' saying suspicious activity was detected on the device and that a data leak could follow. The victim is pressed to send their Signal PIN or the SMS verification code, with wording such as 'don't tell anyone the code, not even Signal employees'. The attacker then registers the victim's number on an attacker-controlled device. The victim loses access, and the attacker obtains profile, settings, contacts and block list and can read incoming messages and impersonate the victim. A stolen PIN does not expose past conversation history. In variant 2 (linked-device abuse), the victim is persuaded to scan a QR code or tap a link that links the attacker's device to the victim's account via Signal's legitimate Linked Devices feature. The victim keeps normal access and is unaware, while the attacker can read messages (reported as up to the last 45 days) and later traffic, plus contact lists and group memberships.
The campaign involves no malware and no vulnerability in Signal; Signal's infrastructure and end-to-end encryption were not compromised. The same social-engineering pattern is reported against WhatsApp (device pairing, including the 'GhostPairing' technique documented December 2025). An update from BfV/BSI on 2026-04-22 said the campaign remained active and was gaining momentum, and extended the warning to WhatsApp and other messengers. Dutch AIVD/MIVD advisory (2026-03-09) separately describes a large-scale Russian state-backed campaign against Signal and WhatsApp accounts of officials, military personnel, civil servants and journalists, with confirmed Dutch government victims; the German authorities have not publicly tied their cases to a specific country. Earlier Google Threat Intelligence research (2025-02-19) documented Russia-aligned clusters (UNC5792/UAC-0195, UNC4221/UAC-0185, APT44, Turla, UNC1151) abusing Signal linked-device QR codes; those are contextual and are not confirmed to be the actor in this campaign.
No network IOCs, phone numbers or malware samples have been published by the German authorities. Detection is largely behavioral: unsolicited 'support' messages requesting codes, unexpected Signal registration-code SMS, unrecognized entries under Settings > Linked Devices, or sudden loss of account access.
MITRE ATT&CK techniques used in TL-2026-3767
Initial Access
T1078 Valid Accounts; T1566.003 Phishing: Spearphishing via Service
Persistence
T1098.005 Account Manipulation: Device Registration
Credential Access
T1111 Multi-Factor Authentication Interception
Execution
Resource Development
Reconnaissance
T1598 Phishing for Information
Defense Evasion
Affected products and versions in Suspected state-sponsored Signal phishing campaign (fake
- Signal Foundation — Signal Messenger (user accounts; no software vulnerability)
Vulnerable versions: Accounts without Registration Lock exposed to PIN/verification-code social engineering - Meta — WhatsApp (similar device-linking and PIN abuse reported)
Vulnerable versions: Accounts exposed to device-pairing social engineering
Remediation for Suspected state-sponsored Signal phishing campaign (fake
Immediate actions
- Never share a Signal PIN or SMS verification code with anyone, including accounts claiming to be Signal Support
- Open Signal Settings > Linked Devices (via profile picture) and remove any unrecognized device
- If you responded to the lure: change the Signal PIN, or delete the account and re-register with a new PIN
- Notify contacts over an alternative channel, block the compromised account, and delete and recreate affected groups
- Contact Signal support through official channels to delete a hijacked account
Workarounds
- Do not engage with unsolicited support accounts via direct message
- Do not scan QR codes or open sgnl://linkdevice links received from unverified senders
Longer-term hardening
- Enable Registration Lock on Signal accounts
- Use disappearing messages to limit exposure of history
- Run awareness training for leadership and high-risk staff on messenger phishing and QR-code linking
- Apply clear data classification; do not use consumer messengers for classified or sensitive government information (AIVD/MIVD guidance)
- Periodically audit linked devices on Signal and WhatsApp
Weaknesses (CWE) in Suspected state-sponsored Signal phishing campaign (fake
Timeline of Suspected state-sponsored Signal phishing campaign (fake
- Google Threat Intelligence documents Russia-aligned clusters abusing Signal's linked-device feature via malicious QR codes (context for the technique)
- BfV and BSI publish a joint warning about a presumably state-controlled actor phishing Signal accounts of politicians, military, diplomats and journalists
- G DATA publishes analysis of the warning, including the fake 'Signal Security Support ChatBot' lure and Linked Devices check
- Press coverage (The Record, The Hacker News) details the two variants: PIN/SMS code theft and QR-code device linking; WhatsApp reported as similarly exposed
- Dutch AIVD and MIVD publish an advisory on a large-scale Russian state-backed campaign against Signal and WhatsApp accounts, with confirmed Dutch government victims
- BfV and BSI update their warning: the campaign remains active and is gaining momentum, extended to WhatsApp and other messengers, with new victim-response guidance
Sources cited for Suspected state-sponsored Signal phishing campaign (fake
- Officials sound the alarm: Phishing attacks on politicians, journalists via Signal messenger (G DATA)
- BfV/BSI joint warning notice on messenger phishing (PDF)
- Attack via Signal: BfV and BSI warn politicians, military personnel, diplomats (heise)
- Signal phishing attacks: BfV and BSI update warning (heise)
- German agencies warn of Signal phishing (The Hacker News)
- Germany warns of phishing campaign on Signal targeting officials, journalists (The Record)
- AIVD/MIVD cybersecurity advisory: phishing via messaging apps Signal and WhatsApp
- Signal and WhatsApp accounts targeted in phishing campaign (Malwarebytes)
- Google Threat Intelligence: Signals of Trouble - Russia-aligned actors targeting Signal Messenger
- Germany warns of Signal account attacks targeting high-profile figures (CyberInsider)
Detection coverage for TL-2026-3767
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3767 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.