German Agencies Warn of Signal Account Hijacking via Support Impersonation and Linked-Device QR Codes

Germany’s Federal Office for the Protection of the Constitution (BfV) and Federal Office for Information Security (BSI) warned of suspected state-linked phishing operations targeting high-ranking individuals—politicians, military officers, diplomats, and investigative journalists—across Germany and Europe via messaging apps, notably Signal. The advisory emphasizes the campaign relies on social engineering, not malware or exploitation of technical vulnerabilities, with attackers contacting targets directly inside the app while impersonating Signal support personnel or a “security chatbot.”

Authorities described two primary tactics to gain covert access to victims’ communications and networks: (1) full account takeover by tricking targets into sharing their Signal PIN or SMS/one-time verification code, enabling attackers to register the account on an attacker-controlled device and lock out the victim; and (2) silent monitoring by persuading targets to scan a QR code that abuses Signal’s legitimate linked devices feature to pair an attacker-controlled device, allowing ongoing access to one-to-one and group chats and contact lists. The agencies noted that while the activity is assessed as likely state-backed, the same methods could be replicated by non-state or financially motivated actors.