Germany has warned of a phishing campaign designed to hijack Signal accounts using social engineering and exploiting user trust. The central idea is as simple as it is dangerous: attackers impersonate Signal support staff and pressure the victim to hand over a PIN or verification codes; With that, they pave the way to take control of the account or spy on incoming messages.

Germany warns: a targeted attack (with clear objectives)

The warning doesn't come from just any blog. It's a joint statement from two German agencies, the Federal Office for the Protection of the Constitution (BfV) and the Federal Office for Information Security (BSI), which warned about phishing attacks carried out through messaging services, with Signal as one of the main targets. In their warning, the agencies describe a scenario of highly targeted attacks; that is, not the typical poorly written mass email, but operations that appear designed for specific victims.

And here's an important detail to understand why this is worrying: the campaign focuses on people with high informational value, such as figures linked to politics, the military, and diplomacy, as well as journalists (including investigative journalists). If your job involves speaking with sources, handling sensitive documents, or coordinating delicate coverage, this type of attack can be a brutal shortcut to compromising future conversations, impersonating your contacts, or infiltrating groups.

Authorities also highlight something that is sometimes lost in public discourse: in this case, malware or exploiting a "movie-worthy" vulnerability is not necessary. Success depends on a human variable: that the user believes they are speaking with legitimate support and hands over information that, under normal circumstances, they would never share.

How does a phishing attack work?

The mechanism, as described in the alerts and the report, revolves around identity theft. The attacker initiates contact by impersonating “Signal Support” (or some credible variant) and uses a classic script: “we detected suspicious activity,” “your account will be blocked,” “we need to verify your identity,” “this must be done now."Urgency fuels phishing because it reduces your ability to suspect, check, and confirm. And what exactly do they ask for? Elements such as the PIN or a verification code (for example, the one received via SMS when someone tries to register a number). The moment the victim shares this information, the attacker can proceed to hijack the account (registering it on a device under their control) or at least to a scenario where they can operate as if they were the victim: sending messages, writing to groups, or navigating the contact ready to escalate the attack. The report also describes another method that can be especially dangerous because it is so “silent”: abusing the device linking process, for example, by inducing the user to scan a QR code. This type of access can allow an attacker to read incoming messages or monitor activity without immediately logging the victim out of their session, delaying detection. isn't.

What can you do to avoid becoming a victim of this scam?

The golden rule is boring, but it saves accounts: no one from support will ever ask for your codes, your PIN, or for you to urgently "verify" via chat. If contacts you claiming to be support within an app and asks for sensitive information, treat it as fraud until proven otherwise.

On a practical level, there are concrete measures that reduce the risk:

The context of the German warning leads to a clear someone conclusion: Signal can be a very useful tool for privacy, but no app protects you if you end up handing over your password.

And in 2026, that "key" is usually a PIN, a temporary code, or a QR code that seems harmless when someone is rushing you. Writing to groups or moving through the contact list to escalate the attack.

The report also describes another method that can be especially dangerous because it is “silent,” which is abusing the device linking process, for example, by inducing the user to scan a QR code. This type of access can allow the attacker to read incoming messages or monitor activity without needing to immediately log the victim out of their session, thus delaying detection. In other words, it doesn't always feel like “my account was stolen”; sometimes it feels like “everything is normal”… until it isn't.

What can you do to avoid becoming a victim of this scam?

The golden rule is boring, but it saves accounts: no one from support will ask you for your codes, your PIN, or for you to “verify” urgently via chat. If someone contacts you claiming to be support within an app and asks for sensitive information, treat it as fraud until proven otherwise. In practical terms, there are concrete measures that reduce the risk:The context of the German warning leads to a clear conclusion: Signal can be a very useful tool for privacy, but no app protects you if you end up handing over your key. And in 2026, that "key" is often a PIN, a temporary code, or a QR code that seems harmless when someone is pressing you. Writing to groups or moving through the contact list to escalate the attack.

The report also describes another method that can be especially dangerous because it is “silent,” which is abusing the device linking process, for example, by inducing the user to scan a QR code. This type of access can allow the attacker to read incoming messages or monitor activity without needing to immediately log the victim out of their session, thus delaying detection. In other words, it doesn't always feel like “my account was stolen”; sometimes it feels like “everything is normal”… until it isn't.

What can you do to avoid becoming a victim of this scam?

The golden rule is boring, but it saves accounts: no one from support will ask you for your codes, your PIN, or for you to “verify” urgently via chat. If someone contacts you claiming to be support within an app and asks for sensitive information, treat it as fraud until proven otherwise. In practical terms, there are concrete measures that reduce the risk: The context of the German warning leads to a clear conclusion: Signal can be a very useful tool for privacy, but no app protects you if you end up handing over your key. And in 2026, that "key" is often a PIN, a temporary code, or a QR code that seems harmless when someone is pressing you.In practical terms, there are concrete measures that reduce the risk: The context of the German warning leads to a clear conclusion: Signal can be a very useful tool for privacy, but no app protects you if you end up handing over your key. And in 2026, that "key" is often a PIN, a temporary code, or a QR code that seems harmless when someone is pressing you.In practical terms, there are concrete measures that reduce the risk: The context of the German warning leads to a clear conclusion: Signal can be a very useful tool for privacy, but no app protects you if you end up handing over your key. And in 2026, that "key" is often a PIN, a temporary code, or a QR code that seems harmless when someone is pressing you.