Germany’s domestic intelligence agency (BfV), together with the Federal Office for Information Security (BSI), has issued a warning about suspected state-sponsored threat actors targeting high-ranking individuals via messaging apps like Signal.
🕵️ Who’s targeted
- Politicians and government officials
- Military officers and diplomats
- Investigative journalists across Germany and Europe
📱 How the attacks work
- No malware, no zero-days — pure social engineering
- Attackers impersonate Signal support or a support chatbot
- Victims are tricked into:
- Sharing a Signal PIN or SMS verification code (full account takeover), or
- Scanning a QR code that silently links the attacker’s device using Signal’s legitimate linked-device feature
🔗 Why this is dangerous
- Attackers gain access to private and group chats
- Contact lists and ongoing conversations are exposed
- Linked-device attacks often go unnoticed, as users rarely check connected devices
🌍 Broader context
- Similar techniques have been used by Russian state-aligned groups, including Sandworm
- The same pairing abuse has appeared in campaigns like GhostPairing, now adopted by cybercriminals
- WhatsApp supports similar functionality and may be vulnerable to comparable abuse
🛡️ Recommended defenses
- Never respond to messages claiming to be from Signal support
- Enable Registration Lock (PIN) in Signal
- Regularly review Settings → Linked devices and remove unknown entries
- Block and report suspicious accounts immediately
⚠️ Key takeaway
This campaign shows how legitimate app features can be weaponized — even secure messaging platforms are vulnerable when trust and urgency are exploited.
