German Federal Office for the Protection of the Constitution warns Signal users of state-linked phishing attack

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

German security agencies warn on 6 February 2026 of state-linked phishing attacks targeting Signal messenger users, primarily European politicians, military, and journalists.

On 6 February 2026, the German Federal Office for the Protection of the Constitution and the Federal Office for Information Security warned of a sophisticated phishing campaign targeting users of the encrypted messenger app Signal. The phishing messages impersonate Signal, claiming the recipient's account was hacked and requesting PIN codes or re-registration of linked devices to capture sensitive information. The attackers employ psychological tricks by warning victims not to share their PIN with others and to only communicate with Signal, thereby gaining trust. Victims are urged to report to German security agencies. Though no official attribution is given, authorities strongly suspect a state actor behind the campaign, as targets include politicians, military personnel, and journalists across Europe. The incident underscores ongoing cyber threats against key societal actors in the European context.

Classification

Confidence: High

The article explicitly details a phishing attack targeting Signal messenger users, describes the likely state-sponsored nature, and lists vulnerable populations, clearly indicating a hostile hybrid warfare aggression event.

Source URL

https://www.tagesschau.de/inland/verfassungsschutz-signal-warnung-100.html

Open source

Provenance

Publisher: extension
Submitted: Apr 28, 2026, 14:35 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Feb 6, 2026, 15:15 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "8c395849-8d9f-4e28-b454-b8fe08202b5c",
  "url": "https://www.tagesschau.de/inland/verfassungsschutz-signal-warnung-100.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Unknown",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Signal",
    "phishing",
    "cyber attack",
    "Germany",
    "Federal Office for the Protection of the Constitution",
    "BSI",
    "state-sponsored",
    "politicians",
    "military",
    "journalists"
  ],
  "nodes": [
    "Node 2: 5th Column"
  ],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": "German Federal Office for the Protection of the Constitution warns Signal users of state-linked phishing attack",
  "description": "On February 6, 2026, the German Federal Office for the Protection of the Constitution and the Federal Office for Information Security issued an unusually explicit warning to users of the Signal messenger app about a state-sophisticated phishing attack. The phishing messages impersonate Signal itself, often via an English-language 'Signal Chat Bot' that falsely claims the victim's account has been hacked and requests the PIN and re-registration. Another variant involves re-registering linked devices. The messages deceptively warn users not to share their PIN with others and to only communicate technically with Signal directly, creating a facade of legitimacy while delivering malicious links and QR codes. The known targets are distributed across Europe, primarily politicians, military personnel, and journalists. Victims are urged to contact the German security agencies. No explicit attribution to a threat actor was made, but authorities strongly suspect state sponsorship.",
  "summary_short": "German security agencies warn on 6 February 2026 of state-linked phishing attacks targeting Signal messenger users, primarily European politicians, military, and journalists.",
  "summary_extended": "On 6 February 2026, the German Federal Office for the Protection of the Constitution and the Federal Office for Information Security warned of a sophisticated phishing campaign targeting users of the encrypted messenger app Signal. The phishing messages impersonate Signal, claiming the recipient's account was hacked and requesting PIN codes or re-registration of linked devices to capture sensitive information. The attackers employ psychological tricks by warning victims not to share their PIN with others and to only communicate with Signal, thereby gaining trust. Victims are urged to report to German security agencies. Though no official attribution is given, authorities strongly suspect a state actor behind the campaign, as targets include politicians, military personnel, and journalists across Europe. The incident underscores ongoing cyber threats against key societal actors in the European context.",
  "actor_primary": "German Federal Office for the Protection of the Constitution",
  "target_primary": null,
  "location_text": "Cyberspace",
  "location_region": "Cyberspace",
  "location_coordinates_lat": 26.4925331,
  "location_coordinates_lon": 92.3308789,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly details a phishing attack targeting Signal messenger users, describes the likely state-sponsored nature, and lists vulnerable populations, clearly indicating a hostile hybrid warfare aggression event.",
  "event_time_utc": "2026-02-06T15:15:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-04-28T14:35:00.691Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "exact",
  "severity_band": "moderate",
  "attribution_confidence_band": "low",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: LowIndependence confirmedTime: ExactLocation: Regional

Source reliability

Info credibility

Event time

Feb 6, 2026, 15:15 UTC

Event time confidence

exact

Location

Cyberspace

Region

Cyberspace

Primary actor

German Federal Office for the Protection of the Constitution

Country

Unknown

Tags

Signal, phishing, cyber attack, Germany, Federal Office for the Protection of the Constitution, BSI, state-sponsored, politicians, military, journalists

Nodes

Node 2: 5th Column

Loading signal...

{ "id": "8c395849-8d9f-4e28-b454-b8fe08202b5c", "url": "https://www.tagesschau.de/inland/verfassungsschutz-signal-warnung-100.html", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Unknown", "source_reliability": "B", "info_credibility": "3", "tags": [ "Signal", "phishing", "cyber attack", "Germany", "Federal Office for the Protection of the Constitution", "BSI", "state-sponsored", "politicians", "military", "journalists" ], "nodes": [ "Node 2: 5th Column" ], "countries": [], "where_text": "Cyberspace", "headline": "German Federal Office for the Protection of the Constitution warns Signal users of state-linked phishing attack", "description": "On February 6, 2026, the German Federal Office for the Protection of the Constitution and the Federal Office for Information Security issued an unusually explicit warning to users of the Signal messenger app about a state-sophisticated phishing attack. The phishing messages impersonate Signal itself, often via an English-language 'Signal Chat Bot' that falsely claims the victim's account has been hacked and requests the PIN and re-registration. Another variant involves re-registering linked devices. The messages deceptively warn users not to share their PIN with others and to only communicate technically with Signal directly, creating a facade of legitimacy while delivering malicious links and QR codes. The known targets are distributed across Europe, primarily politicians, military personnel, and journalists. Victims are urged to contact the German security agencies. No explicit attribution to a threat actor was made, but authorities strongly suspect state sponsorship.", "summary_short": "German security agencies warn on 6 February 2026 of state-linked phishing attacks targeting Signal messenger users, primarily European politicians, military, and journalists.", "summary_extended": "On 6 February 2026, the German Federal Office for the Protection of the Constitution and the Federal Office for Information Security warned of a sophisticated phishing campaign targeting users of the encrypted messenger app Signal. The phishing messages impersonate Signal, claiming the recipient's account was hacked and requesting PIN codes or re-registration of linked devices to capture sensitive information. The attackers employ psychological tricks by warning victims not to share their PIN with others and to only communicate with Signal, thereby gaining trust. Victims are urged to report to German security agencies. Though no official attribution is given, authorities strongly suspect a state actor behind the campaign, as targets include politicians, military personnel, and journalists across Europe. The incident underscores ongoing cyber threats against key societal actors in the European context.", "actor_primary": "German Federal Office for the Protection of the Constitution", "target_primary": null, "location_text": "Cyberspace", "location_region": "Cyberspace", "location_coordinates_lat": 26.4925331, "location_coordinates_lon": 92.3308789, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article explicitly details a phishing attack targeting Signal messenger users, describes the likely state-sponsored nature, and lists vulnerable populations, clearly indicating a hostile hybrid warfare aggression event.", "event_time_utc": "2026-02-06T15:15:00.000Z", "end_time_utc": null, "event_time_confidence": "exact", "created_at": "2026-04-28T14:35:00.691Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "exact", "severity_band": "moderate", "attribution_confidence_band": "low", "attribution_basis": "independent_sources" }