State Hackers Are Hijacking Signal Accounts Across Europe

Two Attacks, One Goal: Read Your Encrypted Messages

Signal is the gold standard for encrypted messaging. Journalists use it to protect sources. Diplomats use it for sensitive communications. Activists rely on it to organize without governments listening in. That reputation makes it the perfect target.

The BfV and BSI outlined two distinct attack methods being used right now against high-value targets across Germany and Europe.

Attack 1: "We're From Signal Support"

The attacker sends a Signal message posing as official Signal support. The message warns that the target's account has a security problem. There's urgency: act now or lose your data.

Then comes the ask: share your Signal PIN or the SMS verification code you just received.

If the target complies, the attacker registers the Signal account on their own device. The victim immediately loses access. Signal shows a notification: "Your device is no longer registered." Incoming and outgoing messages stop. The attacker now owns the account: profile, contacts, block list, everything.

This variant is loud. You'll know something's wrong immediately. The second variant is worse.

Attack 2: The Silent QR Code

Signal lets you link additional devices to your account: a laptop, a tablet. It's a legitimate feature. You scan a QR code and the new device syncs your messages.

The attackers weaponized this.

Under some plausible pretext (a meeting invitation, a document to review, a security check) the target is convinced to scan a QR code. That code doesn't open a link. It silently pairs an attacker-controlled device to the victim's Signal account.

Here's what makes it devastating: the victim stays logged in. Messages keep flowing normally on their phone. No error messages. No warnings. Meanwhile, the attacker's device receives a copy of everything: every message sent and received, every group chat, every contact. The last 45 days of message history sync automatically.

As the German agencies put it: "Successful access enables not only insight into confidential one-on-one communications but also potential compromise of entire networks via group chats."

One compromised diplomat's account exposes every colleague in their group chats. One journalist's account reveals their sources.

Who's Behind It

The BfV and BSI called the attackers "likely state-backed" but didn't name a country. The clues aren't subtle.

In early 2025, Google's Threat Intelligence Group documented identical QR-code pairing attacks against Signal users and attributed them to multiple Russian state-aligned groups: Sandworm (Russia's GRU military intelligence), Star Blizzard (FSB-linked), and two groups tracked as UNC5792 and UNC4221. Microsoft separately confirmed Star Blizzard's involvement.

Ukraine's CERT-UA attributed comparable attacks targeting WhatsApp to Russian hackers. In December 2025, security firm Gen Digital identified a campaign called "GhostPairing" that exploited WhatsApp's identical device-linking feature.

The BfV noted a key detail: "No malware is used, nor are technical vulnerabilities in the messaging services exploited." Pure social engineering. The encryption is fine. The humans are the vulnerability.

Who's Getting Targeted

The advisory names four target groups:

• Politicians: Senior political figures across Germany and Europe
• Military officers: Active duty personnel with access to sensitive operational information
• Diplomats: Diplomatic staff whose compromised group chats could expose entire embassy networks
• Investigative journalists: Reporters whose Signal contacts include confidential sources

These are the exact people who chose Signal specifically because they need encrypted communications. The attackers aren't trying to break the encryption. They're going around it.

Signal's Trust Problem

Signal's device-linking feature was designed for convenience. Scan a QR code, and your messages appear on a second device. It's fast, it's simple, and it trusts that you're the one scanning.

That trust is the vulnerability. Signal has no way to distinguish between you linking your own laptop and an attacker tricking you into linking their surveillance device. Once linked, the attacker's device is just another "you," receiving real-time copies of every conversation.

WhatsApp has the same architecture. The BfV and BSI explicitly warned that these attacks apply to WhatsApp too: "comparable risks exist due to similar messaging functionalities."

The uncomfortable reality: the feature that makes encrypted messaging convenient is the same feature that makes it exploitable. No code needs to be broken. No zero-day exploits needed. Just a convincing story and a QR code.

What You Should Do Right Now

If you're in one of the target groups (journalist, politician, diplomat, military) make checking linked devices a weekly habit. Set a recurring reminder. It's the only way to catch a silent compromise before too much damage is done.

Encryption Works. Social Engineering Works Better.

Signal's end-to-end encryption hasn't been broken. The math is sound. But encryption only protects messages in transit, between your device and the recipient's device. If the attacker's device becomes one of the recipient's devices, encryption delivers your messages directly to them, perfectly decrypted.

This is the fundamental tension in secure messaging: usability features like device linking make encrypted messaging practical for normal people. They also make it exploitable by sophisticated adversaries who specialize in tricking normal people.

Russia's intelligence services didn't need a zero-day. They didn't need Pegasus or Predator. They needed a convincing pretext and a QR code. That's cheaper, harder to detect, and works against anyone who lets their guard down for a moment.

The lesson isn't to stop using Signal. It's still the best option for encrypted messaging. The lesson is that no technology protects you if you hand the keys to the wrong person. Check your linked devices. Enable Registration Lock. And treat any unsolicited request involving your Signal account as an attack, because it probably is.

References

1. BleepingComputer - Germany Warns of Signal Account Hijacking Targeting Senior Figures (February 6, 2026)
2. The Hacker News - German Agencies Warn of Signal Phishing Targeting Politicians, Military, Journalists (February 2026)
3. Help Net Security - State-Backed Phishing Attacks Targeting Military Officials and Journalists on Signal (February 6, 2026)
4. Cyber Insider - Germany Warns of Signal Account Attacks Targeting High-Profile Figures (February 2026)
5. Heise Online - Attack via Signal: BfV and BSI Warn Politicians, Military Personnel, Diplomats (February 2026)
6. WebProNews - Signal Under Siege: How Russian-Linked Hackers Are Exploiting the Encrypted Messenger (February 2026)

Related Coverage

• Predator Spyware Hides iPhone Recording Indicators. When spyware vendors don't need social engineering because they have zero-days instead
• UK and Sweden Push Encryption Backdoors. Governments want to break the encryption that state hackers are already bypassing
• ICE's Paragon Spyware Targets Signal and WhatsApp. The US government's own tools for intercepting encrypted messages
• Signal Will Leave Europe Before Breaking Encryption. The app's stance as governments pressure encrypted messaging
• EU Chat Control: The Plan to Scan Every Private Message. The legislative push to scan encrypted chats Europe-wide