Signal Account Takeover Campaign Targeting German Officials

A social-engineering campaign targeting Signal and WhatsApp accounts has hit prominent German officials and security figures, including former BND vice president Arndt Freytag von Loringhoven. Attackers reportedly impersonated Signal support and tricked victims into disclosing their PINs, enabling account compromise and follow-on abuse. In Freytag von Loringhoven’s case, the hijacked account was then used to send a malicious link to his contacts before he warned them and deleted the account. German authorities had already classified the activity as security-relevant and advised potential victims to check for signs such as unknown linked devices and unexpected re-registration prompts.

The campaign appears to be part of a broader espionage-focused operation affecting politicians and officials in Germany, with investigators reportedly suspecting a connection to Russian hybrid activity. One additional report references the same incident only in passing while discussing a separate German cybersecurity legislative proposal, reinforcing that the compromise of the former intelligence official was one of several recent security incidents shaping the policy debate. A separate article on Frankfurt police use of a mobile facial-recognition app is not related to the account-takeover campaign and should be excluded.