Loading signal...
Signal
Submitted
Apr 26, 2026, 13:49 UTC
Germany probes a Russian-suspected phishing campaign compromising about 300 Signal messenger accounts of high-profile political and military figures on 26 April 2026.
On April 26, 2026, German authorities launched a criminal investigation into a sophisticated Russian-attributed espionage phishing campaign compromising approximately 300 Signal messenger accounts belonging to high-profile government officials, politicians, journalists, military personnel, and intelligence officers. The attack exploited phishing messages falsely claiming to be from 'SignalSecurity Support ChatBots,' prompting victims to scan QR codes that linked attacker-controlled devices enabling real-time monitoring and data access for 45 days. Key victims included Federal Education Minister Karin Prien, Housing Minister Verena Hubertz, and Bundestag President Julia Klöckner. The Federal Office for the Protection of the Constitution and the Federal Office for Information Security intervened to stop data leaks. This incident follows warnings from Dutch intelligence about Russian hackers compromising Signal and WhatsApp accounts of their officials. Germany has already imposed strict prohibitions on private mobile devices in sensitive Defense Ministry meetings since February 2026 to counter such threats. The campaign underscores ongoing Russian espionage attempts targeting European political and military communication channels.
Confidence: High
The article explicitly reports a criminal espionage investigation by German authorities into a phishing campaign targeting high-profile users attributed to Russian hackers, confirming aggressive hybrid warfare activity in cyberspace.
Source URL
https://militarnyi.com/en/news/germany-opens-espionage-probe-over-signal-russia-suspected
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "12b1be37-02ee-4a51-871c-a5e9dd903065",
"url": "https://militarnyi.com/en/news/germany-opens-espionage-probe-over-signal-russia-suspected",
"source": "extension",
"status": "approved",
"category": "Intelligence & Espionage",
"subcategory": "Human Intelligence (HUMINT)",
"incident_type": "Recruitment of locals",
"country": "Germany",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"Germany",
"Russia",
"espionage",
"Signal messenger",
"phishing campaign",
"offensive cyber operations",
"Russian hackers",
"Federal Prosecutor",
"intelligence",
"cyberspace attack"
],
"nodes": [],
"countries": [
"Germany"
],
"where_text": "Cyberspace",
"headline": "Germany Opens Espionage Probe Over Signal Phishing Campaign, Russia Suspected",
"description": "On April 26, 2026, the German Federal Prosecutor's Office initiated a criminal investigation into a phishing campaign targeting about 300 high-profile users of the Signal messenger, including Federal Education Minister Karin Prien, Housing Minister Verena Hubertz, and Bundestag President Julia Klöckner. Germany suspects Russia as the main perpetrator behind the espionage attempt. The campaign involved sending phishing messages disguised as Signal support chatbots directing victims to scan a QR code, allowing attackers to link another device to the victim's Signal account and access chat histories, files, and contact data for up to 45 days. The Federal Office for the Protection of the Constitution and the Federal Office for Information Security mitigated the breach after confirming data leaks. The affected users included government officials, journalists, think tanks, intelligence officers, and military personnel. German authorities emphasize Signal never sends support messages via the app, labeling all such messages phishing attempts. This attack follows similar compromises of Dutch military and government officials' WhatsApp and Signal accounts attributed to Russian hackers. In response to such risks, Germany's Defense Ministry has banned private mobile devices from meetings discussing confidential information since February 2026.",
"summary_short": "Germany probes a Russian-suspected phishing campaign compromising about 300 Signal messenger accounts of high-profile political and military figures on 26 April 2026.",
"summary_extended": "On April 26, 2026, German authorities launched a criminal investigation into a sophisticated Russian-attributed espionage phishing campaign compromising approximately 300 Signal messenger accounts belonging to high-profile government officials, politicians, journalists, military personnel, and intelligence officers. The attack exploited phishing messages falsely claiming to be from 'SignalSecurity Support ChatBots,' prompting victims to scan QR codes that linked attacker-controlled devices enabling real-time monitoring and data access for 45 days. Key victims included Federal Education Minister Karin Prien, Housing Minister Verena Hubertz, and Bundestag President Julia Klöckner. The Federal Office for the Protection of the Constitution and the Federal Office for Information Security intervened to stop data leaks. This incident follows warnings from Dutch intelligence about Russian hackers compromising Signal and WhatsApp accounts of their officials. Germany has already imposed strict prohibitions on private mobile devices in sensitive Defense Ministry meetings since February 2026 to counter such threats. The campaign underscores ongoing Russian espionage attempts targeting European political and military communication channels.",
"actor_primary": "Russian hackers",
"target_primary": null,
"location_text": "Germany",
"location_region": null,
"location_coordinates_lat": 51.165691,
"location_coordinates_lon": 10.451526,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly reports a criminal espionage investigation by German authorities into a phishing campaign targeting high-profile users attributed to Russian hackers, confirming aggressive hybrid warfare activity in cyberspace.",
"event_time_utc": "2026-04-26T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "exact",
"created_at": "2026-04-26T13:49:00.042Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "exact",
"severity_band": "moderate",
"attribution_confidence_band": "high",
"attribution_basis": "independent_sources"
}Source reliability
B
Info credibility
3
Event time
Apr 26, 2026, 00:00 UTC
Event time confidence
exact
Location
Germany
Primary actor
Russian hackers
Country
Germany
Countries
Germany
Tags
Germany, Russia, espionage, Signal messenger, phishing campaign, offensive cyber operations, Russian hackers, Federal Prosecutor, intelligence, cyberspace attack
Signal
Submitted
Apr 26, 2026, 13:49 UTC
Germany probes a Russian-suspected phishing campaign compromising about 300 Signal messenger accounts of high-profile political and military figures on 26 April 2026.
On April 26, 2026, German authorities launched a criminal investigation into a sophisticated Russian-attributed espionage phishing campaign compromising approximately 300 Signal messenger accounts belonging to high-profile government officials, politicians, journalists, military personnel, and intelligence officers. The attack exploited phishing messages falsely claiming to be from 'SignalSecurity Support ChatBots,' prompting victims to scan QR codes that linked attacker-controlled devices enabling real-time monitoring and data access for 45 days. Key victims included Federal Education Minister Karin Prien, Housing Minister Verena Hubertz, and Bundestag President Julia Klöckner. The Federal Office for the Protection of the Constitution and the Federal Office for Information Security intervened to stop data leaks. This incident follows warnings from Dutch intelligence about Russian hackers compromising Signal and WhatsApp accounts of their officials. Germany has already imposed strict prohibitions on private mobile devices in sensitive Defense Ministry meetings since February 2026 to counter such threats. The campaign underscores ongoing Russian espionage attempts targeting European political and military communication channels.
Confidence: High
The article explicitly reports a criminal espionage investigation by German authorities into a phishing campaign targeting high-profile users attributed to Russian hackers, confirming aggressive hybrid warfare activity in cyberspace.
Source URL
https://militarnyi.com/en/news/germany-opens-espionage-probe-over-signal-russia-suspected
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "12b1be37-02ee-4a51-871c-a5e9dd903065",
"url": "https://militarnyi.com/en/news/germany-opens-espionage-probe-over-signal-russia-suspected",
"source": "extension",
"status": "approved",
"category": "Intelligence & Espionage",
"subcategory": "Human Intelligence (HUMINT)",
"incident_type": "Recruitment of locals",
"country": "Germany",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"Germany",
"Russia",
"espionage",
"Signal messenger",
"phishing campaign",
"offensive cyber operations",
"Russian hackers",
"Federal Prosecutor",
"intelligence",
"cyberspace attack"
],
"nodes": [],
"countries": [
"Germany"
],
"where_text": "Cyberspace",
"headline": "Germany Opens Espionage Probe Over Signal Phishing Campaign, Russia Suspected",
"description": "On April 26, 2026, the German Federal Prosecutor's Office initiated a criminal investigation into a phishing campaign targeting about 300 high-profile users of the Signal messenger, including Federal Education Minister Karin Prien, Housing Minister Verena Hubertz, and Bundestag President Julia Klöckner. Germany suspects Russia as the main perpetrator behind the espionage attempt. The campaign involved sending phishing messages disguised as Signal support chatbots directing victims to scan a QR code, allowing attackers to link another device to the victim's Signal account and access chat histories, files, and contact data for up to 45 days. The Federal Office for the Protection of the Constitution and the Federal Office for Information Security mitigated the breach after confirming data leaks. The affected users included government officials, journalists, think tanks, intelligence officers, and military personnel. German authorities emphasize Signal never sends support messages via the app, labeling all such messages phishing attempts. This attack follows similar compromises of Dutch military and government officials' WhatsApp and Signal accounts attributed to Russian hackers. In response to such risks, Germany's Defense Ministry has banned private mobile devices from meetings discussing confidential information since February 2026.",
"summary_short": "Germany probes a Russian-suspected phishing campaign compromising about 300 Signal messenger accounts of high-profile political and military figures on 26 April 2026.",
"summary_extended": "On April 26, 2026, German authorities launched a criminal investigation into a sophisticated Russian-attributed espionage phishing campaign compromising approximately 300 Signal messenger accounts belonging to high-profile government officials, politicians, journalists, military personnel, and intelligence officers. The attack exploited phishing messages falsely claiming to be from 'SignalSecurity Support ChatBots,' prompting victims to scan QR codes that linked attacker-controlled devices enabling real-time monitoring and data access for 45 days. Key victims included Federal Education Minister Karin Prien, Housing Minister Verena Hubertz, and Bundestag President Julia Klöckner. The Federal Office for the Protection of the Constitution and the Federal Office for Information Security intervened to stop data leaks. This incident follows warnings from Dutch intelligence about Russian hackers compromising Signal and WhatsApp accounts of their officials. Germany has already imposed strict prohibitions on private mobile devices in sensitive Defense Ministry meetings since February 2026 to counter such threats. The campaign underscores ongoing Russian espionage attempts targeting European political and military communication channels.",
"actor_primary": "Russian hackers",
"target_primary": null,
"location_text": "Germany",
"location_region": null,
"location_coordinates_lat": 51.165691,
"location_coordinates_lon": 10.451526,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly reports a criminal espionage investigation by German authorities into a phishing campaign targeting high-profile users attributed to Russian hackers, confirming aggressive hybrid warfare activity in cyberspace.",
"event_time_utc": "2026-04-26T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "exact",
"created_at": "2026-04-26T13:49:00.042Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "exact",
"severity_band": "moderate",
"attribution_confidence_band": "high",
"attribution_basis": "independent_sources"
}Source reliability
B
Info credibility
3
Event time
Apr 26, 2026, 00:00 UTC
Event time confidence
exact
Location
Germany
Primary actor
Russian hackers
Country
Germany
Countries
Germany
Tags
Germany, Russia, espionage, Signal messenger, phishing campaign, offensive cyber operations, Russian hackers, Federal Prosecutor, intelligence, cyberspace attack