Background and Timeline: On February 6, 2026, Germany’s domestic intelligence agency issued a warning regarding a Signal phishing campaign. The campaign has been active across Germany and Europe, targeting a high-density pool of sensitive government targets. This warning follows a trend in 2026 where state actors are increasingly shifting their focus from email to encrypted messaging apps.

Modus Operandi: Suspected state-sponsored threat actors send phishing messages impersonating Signal support, creating a false sense of urgency to trick victims. They convince high-ranking individuals to share their verification codes, which allows the attackers to hijack the accounts and gain unauthorized access. The campaign abuses the platform’s legitimate features to access confidential communications without using malware.

Victims and Financial Impact: Targeted individuals include high-ranking German and European officials, military personnel, diplomats, and journalists. While no direct financial theft has been reported, the breach of these accounts exposes highly confidential government discussions and strategic travel plans. This represents a significant risk to national security and diplomatic integrity across the EU.

Investigation and Agencies Involved: German intelligence agencies have mapped the campaign’s TTPs and are working to identify the origins of the impersonation messages. They have issued a formal advisory for all government personnel to enable “registration lock” on their Signal accounts to prevent unauthorized hijacking. The investigation is monitoring the campaign’s shift toward abusing other trusted systems.

Arrests and Suspects: No suspects have been identified or arrested yet, though the sophisticated nature of the lures points to state-aligned groups. Investigators believe the attackers are aiming for long-term intelligence collection rather than immediate disruption. The actors demonstrate high operational security by avoiding the use of identifiable malware in their initial access phase.

Broader Implications and Trends: Modern cyber threats are increasingly showing up inside the tools and ecosystems that organizations trust every day. This highlights that “identity is the new perimeter,” as social engineering on encrypted platforms can bypass traditional security controls. Espionage is moving away from exploits toward abusing trusted user actions and flows.