# Suspected state-sponsored Signal phishing campaign (fake Signal Support chatbot, PIN/verification-code theft and linked-device abuse) targeting politicians, military, diplomats and journalists in Germany and Europe

> Germany's BfV and BSI warned of a likely state-controlled actor impersonating 'Signal Support' / 'Signal Security ChatBot' to trick high-profile targets into disclosing Signal PINs or SMS verification codes, or into scanning a QR code that links an attacker-controlled device. No malware or Signal vulnerability is involved; legitimate account features are abused to take over accounts or covertly read messages and contacts.

- **Published:** 2026-10-16T18:50:15Z
- **Last reviewed:** 2026-10-16T18:50:15Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3767
- **ID:** TL-2026-3767
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-02-06 the German Federal Office for the Protection of the Constitution (BfV) and Federal Office for Information Security (BSI) issued a joint warning about a phishing campaign on Signal run by a presumably state-controlled actor. Reported targets are high-ranking individuals from politics, the military and diplomacy, plus investigative journalists in Germany and Europe. The authorities state that, given the target set, known cases are likely attributable to a state-controlled cyber actor; no country or group is named.

Two variants are described. In variant 1 (account takeover), the victim receives a Signal message from an account posing as 'Signal Support' or 'Signal Security ChatBot' saying suspicious activity was detected on the device and that a data leak could follow. The victim is pressed to send their Signal PIN or the SMS verification code, with wording such as 'don't tell anyone the code, not even Signal employees'. The attacker then registers the victim's number on an attacker-controlled device. The victim loses access, and the attacker obtains profile, settings, contacts and block list and can read incoming messages and impersonate the victim. A stolen PIN does not expose past conversation history. In variant 2 (linked-device abuse), the victim is persuaded to scan a QR code or tap a link that links the attacker's device to the victim's account via Signal's legitimate Linked Devices feature. The victim keeps normal access and is unaware, while the attacker can read messages (reported as up to the last 45 days) and later traffic, plus contact lists and group memberships.

The campaign involves no malware and no vulnerability in Signal; Signal's infrastructure and end-to-end encryption were not compromised. The same social-engineering pattern is reported against WhatsApp (device pairing, including the 'GhostPairing' technique documented December 2025). An update from BfV/BSI on 2026-04-22 said the campaign remained active and was gaining momentum, and extended the warning to WhatsApp and other messengers. Dutch AIVD/MIVD advisory (2026-03-09) separately describes a large-scale Russian state-backed campaign against Signal and WhatsApp accounts of officials, military personnel, civil servants and journalists, with confirmed Dutch government victims; the German authorities have not publicly tied their cases to a specific country. Earlier Google Threat Intelligence research (2025-02-19) documented Russia-aligned clusters (UNC5792/UAC-0195, UNC4221/UAC-0185, APT44, Turla, UNC1151) abusing Signal linked-device QR codes; those are contextual and are not confirmed to be the actor in this campaign.

No network IOCs, phone numbers or malware samples have been published by the German authorities. Detection is largely behavioral: unsolicited 'support' messages requesting codes, unexpected Signal registration-code SMS, unrecognized entries under Settings > Linked Devices, or sudden loss of account access.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1585 Establish Accounts
- T1566.003 Phishing: Spearphishing via Service
- T1204 User Execution
- T1098.005 Account Manipulation: Device Registration
- T1684.001 Impersonation
- T1111 Multi-Factor Authentication Interception
- T1078 Valid Accounts

## Sources

- [Officials sound the alarm: Phishing attacks on politicians, journalists via Signal messenger (G DATA)](https://blog.gdatasoftware.com/2026/02/38357-phishing-signal-messenger)
- [BfV/BSI joint warning notice on messenger phishing (PDF)](https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/praevention_wirtschafts-und_wissenschaftsschutz/2026-02-06-gemeinsame-warnmitteilung-phishing.pdf)
- [Attack via Signal: BfV and BSI warn politicians, military personnel, diplomats (heise)](https://heise.de/-11168293)
- [Signal phishing attacks: BfV and BSI update warning (heise)](https://heise.de/-11268155)
- [German agencies warn of Signal phishing (The Hacker News)](https://thehackernews.com/2026/02/german-agencies-warn-of-signal-phishing.html)
- [Germany warns of phishing campaign on Signal targeting officials, journalists (The Record)](https://therecord.media/germany-warns-phishing-campaign-signal-gov-officials-journalists)
- [AIVD/MIVD cybersecurity advisory: phishing via messaging apps Signal and WhatsApp](https://english.aivd.nl/documents/2026/03/09/cybersecurity-advisory.-phishing-via-messaging-apps-signal-and-whatsapp)
- [Signal and WhatsApp accounts targeted in phishing campaign (Malwarebytes)](https://www.malwarebytes.com/blog/news/2026/03/signal-and-whatsapp-accounts-targeted-in-phishing-campaign)
- [Google Threat Intelligence: Signals of Trouble - Russia-aligned actors targeting Signal Messenger](https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger)
- [Germany warns of Signal account attacks targeting high-profile figures (CyberInsider)](https://cyberinsider.com/germany-warns-of-signal-account-attacks-targeting-high-profile-figures/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3767