State-Backed Hackers Target Military Officials, Journalists via Signal

A suspected state-sponsored hacking group is actively targeting high-profile individuals across Europe. The Federal Office for the Protection of the Constitution (BfV) and the Federal Office for Information Security (BSI) have identified a coordinated espionage campaign aimed at military officials, diplomats, politicians, and investigative journalists.​

Instead, they are using “social engineering” to weaponize the legitimate security features of the Signal messaging app against its users.

The goal of this campaign is to silently gain access to private chats, group conversations, and contact lists without raising technical alarms.​

A new joint security advisory issued this week by German intelligence agencies warns that a suspected state-sponsored hacking group.

According to the advisory released on February 6, 2026, the attackers are bypassing traditional malware and technical exploits.

The “Signal Support” Impersonation

The first observed method involves a direct account takeover. Attackers send a message to the target posing as “Signal Support” or a “Signal Security ChatBot.”

The message typically claims that suspicious activity or a data leak has been detected on the user’s device. To “secure” the account, the user is urgently asked to verify their identity by providing a six-digit verification code.​

In reality, the attackers have triggered a registration request for the victim’s phone number on a device they control.

If the victim shares the SMS verification code or their Signal PIN with the fake support bot, the attackers can successfully register the account on their own device, effectively locking the legitimate user out and taking over their identity.​

The second method allows attackers to spy on conversations while the victim retains access to their account.

Attackers trick the target into scanning a QR code under a false pretext such as a request to “verify a second device” or “fix a connection issue”.​

Signal, like WhatsApp, allows users to link additional devices (like tablets or desktops) by scanning a QR code.

By convincing a victim to scan an attacker-controlled code, the hackers can link their own device to the victim’s account. This grants them persistent access to read new messages, view contact lists, and even access chat history from the previous 45 days.​

How to Stay Safe

The intelligence agencies highlight that this campaign is particularly dangerous because it does not rely on infecting a phone with viruses. It exploits human trust and the standard functionality of the app.

The BSI and BfV strongly advise users to never share their Signal PIN or SMS codes with anyone Signal Support will never ask for them via chat.

Users are also urged to regularly check their “Linked Devices” list in the app’s settings and immediately remove any unknown connections.

Enabling the “Registration Lock” feature in Signal settings adds an extra layer of protection, preventing attackers from re-registering a number without the user’s specific PIN.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.