Quick Summary
German security authorities have issued warnings about state-backed phishing attacks targeting military officials, diplomats, and journalists via Signal. The attackers impersonate Signal support to trick users into revealing security PINs or scanning malicious QR codes, allowing them to take over accounts. This poses significant risks to sensitive communications and professional networks across Germany and Europe.
The Securityish Brief
German security agencies, including the Federal Office for the Protection of the Constitution (BfV) and the Federal Office for Information Security (BSI), have alerted the public about phishing attempts targeting senior political figures, military officials, diplomats, and investigative journalists. These attacks are primarily conducted through the Signal messaging app, with the potential for similar tactics to be used against WhatsApp users.
The phishing attempts involve two main strategies. In the first, attackers pose as official Signal support representatives, claiming urgent security issues that require the target to provide a security PIN or verification code. If the target complies, the attackers can take control of the victim’s account.
The second approach involves convincing the target to scan a QR code, which links an additional device to their account. This allows attackers to monitor conversations and access private messages without immediately locking the user out, thereby compromising sensitive discussions and professional networks.
Authorities emphasize that successful account access can lead to significant intelligence-gathering opportunities and potential criminal activities. Users who fall victim to these attacks will notice that their Signal app indicates their device is no longer registered, disrupting their messaging capabilities.
To combat these threats, German authorities advise Signal users to refrain from responding to messages from supposed support accounts and to block and report these communications. Users should never share PINs via messages and should enable account protection features like registration locks.
Protecting Yourself from Phishing Attacks
Regularly reviewing linked devices in the Signal app is crucial for maintaining account security. Users are encouraged to contact authorities if they suspect they have been targeted by these phishing attempts.
Key Takeaways
- Do not respond to messages from accounts claiming to be Signal support.
- Never share your security PIN or verification codes via messaging apps.
- Enable registration locks and other account protection features on your Signal account.
- Only scan QR codes when you are intentionally linking your own devices.
- Regularly review the devices connected to your Signal account in the settings.
Key Terms & Concepts
- Phishing: In this article, phishing refers to attempts to trick users into revealing sensitive information, such as security PINs or verification codes.
- QR Code: A QR code is a type of matrix barcode that can link to websites or applications when scanned, but can also be used maliciously.
- Signal: Signal is a secure messaging app that offers end-to-end encryption for private communications.
- BfV: The BfV, or Federal Office for the Protection of the Constitution, is a German agency responsible for domestic intelligence and security.
- BSI: The BSI, or Federal Office for Information Security, is a German agency that focuses on cybersecurity and information security.
Read the original article here: https://www.helpnetsecurity.com/2026/02/06/state-linked-phishing-europe-journalists-signal/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
