What's happened
German federal prosecutors have been investigating suspected cyberattacks on Signal accounts since mid-February 2026. Around 300 political figures and journalists have been targeted through phishing campaigns linked to Russian state hackers. The attacks involve fake Signal support messages that enable hackers to access private chats and data. Germany has not officially attributed the attacks to Russia, but authorities warn of ongoing threats to political and civil service accounts.
What's behind the headline?
The investigation into Signal phishing attacks highlights the ongoing escalation of cyber espionage linked to Russia. The targeted nature of the attacks, involving high-profile political figures and journalists, indicates a strategic effort to gather intelligence and influence political discourse. The use of fake support chatbots to trick users into revealing PINs and scanning QR codes demonstrates the sophistication of these campaigns. This will likely increase pressure on European governments to strengthen cybersecurity measures and improve user awareness. The lack of official attribution to Russia suggests diplomatic sensitivities, but the consistent pattern of targeting indicates Moscow's continued engagement in cyber operations against Western interests. The upcoming months will see intensified efforts to counteract these threats and possibly retaliate against perceived aggressors, shaping the future landscape of European cyber defense.
How we got here
Since Russia's invasion of Ukraine in February 2022, European countries have faced increased cyber threats linked to Moscow. Germany and the Netherlands have warned about large-scale campaigns targeting officials and journalists, with suspected state-sponsored actors using phishing tactics to compromise secure messaging apps like Signal. German authorities have publicly linked these activities to Russian cyber actors, although Moscow denies involvement.
Our analysis
The Independent reports that German authorities have been investigating these attacks since mid-February, with around 300 accounts compromised, including several cabinet members. AP News confirms that German officials have linked the attacks to Russian state hackers, citing warnings from domestic intelligence. Politico highlights that high-profile figures like CDU leader Klöckner have been targeted, with European agencies warning of a broader wave of attacks. All sources agree that the attacks involve phishing campaigns using fake Signal support messages, but differ in emphasizing the political implications and the level of official attribution. The German government has not officially confirmed Russia's involvement, but the pattern of targeting and the warnings issued suggest a strategic campaign aimed at destabilizing political communication channels.
More on these topics
-
Russia - Country
Russia, or the Russian Federation, is a transcontinental country located in Eastern Europe and Northern Asia. Covering an area of 17,125,200 square kilometres, it is the largest country in the world by area, spanning more than one-eighth of the Earth's in
-
Signal - Software
Signal is a cross-platform encrypted messaging service developed by the Signal Foundation and Signal Messenger. It uses the Internet to send one-to-one and group messages, which can include files, voice notes, images and videos.
-
Germany - Country in Europe
Germany, officially the Federal Republic of Germany, is a country in Central and Western Europe. Covering an area of 357,022 square kilometres, it lies between the Baltic and North seas to the north, and the Alps to the south.