Loading story…
A social-engineering campaign targeting Signal and WhatsApp accounts has hit prominent German officials and security figures, including former BND vice president Arndt Freytag von Loringhoven. Attackers reportedly impersonated Signal support and tricked victims into disclosing their PINs, enabling account compromise and follow-on abuse. In Freytag von Loringhoven’s case, the hijacked account was then used to send a malicious link to his contacts before he warned them and deleted the account. German authorities had already classified the activity as security-relevant and advised potential victims to check for signs such as unknown linked devices and unexpected re-registration prompts.
The campaign appears to be part of a broader espionage-focused operation affecting politicians and officials in Germany, with investigators reportedly suspecting a connection to Russian hybrid activity. One additional report references the same incident only in passing while discussing a separate German cybersecurity legislative proposal, reinforcing that the compromise of the former intelligence official was one of several recent security incidents shaping the policy debate. A separate article on Frankfurt police use of a mobile facial-recognition app is not related to the account-takeover campaign and should be excluded.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Reporting on 2026-04-23 said the Signal phishing campaign had successfully compromised Bundestag President Julia Klöckner, at least one additional Bundestag member, and staff at major German newsrooms. Germany's domestic intelligence service also warned that numerous parliamentary Signal groups may be under undetected monitoring, indicating broader impact on political and media communications.
Signal stated that its encryption and infrastructure were not compromised in the incidents. The company said the account takeovers resulted from phishing and misuse of legitimate features, not from a software vulnerability in Signal itself.
Dutch intelligence agencies publicly attributed a wider global campaign targeting government officials, military personnel, civil servants, and possibly journalists to Russia-linked threat actors. The attribution connected the German cases to a broader espionage effort against messaging app users.
German authorities assessed the Signal and WhatsApp account takeover activity as security-relevant after the targeting of senior officials came to light. The incidents were described as phishing and abuse of legitimate platform features rather than a compromise of Signal's encryption or infrastructure.
A targeted social-engineering campaign affected high-ranking German officials, including former BND Vice President Arndt Freytag von Loringhoven, by impersonating Signal support and soliciting PINs or verification data. In some cases, attackers abused Signal's linked devices feature to maintain access to victim communications.
At the end of February 2026, Germany's Federal Ministry of the Interior published the draft law "Gesetz zur Stärkung der Cybersicherheit." The proposal would expand the powers of the Bundespolizei, BKA, and BSI to take active measures such as shutting down systems, redirecting traffic, and altering or deleting data on IT systems.
In mid-February 2026, German federal prosecutors began a preliminary investigation on suspicion of espionage related to the Signal phishing campaign targeting politicians, officials, military personnel, diplomats, and journalists. The probe marked an early law-enforcement response before the campaign's broader public disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcesecurityaffairs.com
Open sourceinfosec.pub
Open sourcenetzpolitik.org
Open sourcenetzpolitik.org
Open sourcesecurityaffairs.com
Open sourcenetzpolitik.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Germany’s **Federal Office for the Protection of the Constitution (BfV)** and **Federal Office for Information Security (BSI)** warned of suspected **state-linked phishing** operations targeting high-ranking individuals—politicians, military officers, diplomats, and investigative journalists—across Germany and Europe via messaging apps, notably **Signal**. The advisory emphasizes the campaign relies on **social engineering**, not malware or exploitation of technical vulnerabilities, with attackers contacting targets directly inside the app while impersonating *Signal* support personnel or a “security chatbot.” Authorities described two primary tactics to gain covert access to victims’ communications and networks: (1) **full account takeover** by tricking targets into sharing their Signal **PIN** or **SMS/one-time verification code**, enabling attackers to register the account on an attacker-controlled device and lock out the victim; and (2) **silent monitoring** by persuading targets to scan a **QR code** that abuses Signal’s legitimate `linked devices` feature to pair an attacker-controlled device, allowing ongoing access to one-to-one and group chats and contact lists. The agencies noted that while the activity is assessed as likely state-backed, the same methods could be replicated by non-state or financially motivated actors.
Jun 29, 2026
The Dutch intelligence and military security services (**AIVD** and **MIVD**) warned of a **large-scale Russian cyber campaign** targeting individual **Signal** and **WhatsApp** accounts—particularly those of government officials, journalists, and military personnel—by persuading victims to disclose **security verification codes** and **PINs**. The activity does **not** involve breaking end-to-end encryption or exploiting a technical vulnerability in the apps; instead, it abuses legitimate account and security workflows. One commonly observed tactic is impersonation of a *Signal Support* chatbot to solicit verification information, enabling account takeover and access to messages and group chats. The agencies also reported abuse of the apps’ **“linked devices”** functionality, where attackers attempt to attach an additional device to a victim’s account to mirror messages in real time. AIVD/MIVD assessed that the campaign has already produced victims, including within the Dutch government, and that attackers likely accessed sensitive information as a result. Separate reporting about a fake *Red Alert* Android app used to spy on Israeli users describes a different mobile-malware operation (SMS lure, sideloaded trojanized app, extensive permissions, and data exfiltration) and is not part of the Signal/WhatsApp account-takeover campaign.
Jun 29, 2026
Ukraine’s Security Service (**SBU**) said, in coordination with the **FBI**, it uncovered a long-running Russian campaign that used social engineering to compromise messaging accounts belonging to government officials, military personnel, politicians, activists, journalists, and other high-value targets in Ukraine, Europe, and the United States. According to Ukrainian and U.S. authorities, the attackers impersonated messaging-platform support teams in text and in-app messages, often contacting victims in the morning, and tricked them into handing over credentials and other sensitive account data to gain access to military, political, economic, and personal communications. The **FBI** and **CISA** separately warned that Russian intelligence-linked operators are specifically phishing **Signal Backup Recovery Keys**, allowing them to restore backups, read private and group message history, and take over accounts without breaking Signal’s encryption. The updated advisory said the broader operation has already compromised thousands of accounts worldwide and is tracked publicly as **`UNC5792`** and **`UNC4221`**, with links to multiple Russian intelligence services, including **FSB**-associated personnel and Russian military services. U.S. and allied agencies in the Netherlands, Germany, and France urged users to distrust messages claiming to be from Signal support, never share verification codes, PINs, or Recovery Keys, and review linked devices for unauthorized access.
Jun 30, 2026