German Federal Office for the Protection of the Constitution warns Signal users of state-linked phishing attack

On 6 February 2026, the German Federal Office for the Protection of the Constitution and the Federal Office for Information Security warned of a sophisticated phishing campaign targeting users of the encrypted messenger app Signal. The phishing messages impersonate Signal, claiming the recipient's account was hacked and requesting PIN codes or re-registration of linked devices to capture sensitive information. The attackers employ psychological tricks by warning victims not to share their PIN with others and to only communicate with Signal, thereby gaining trust. Victims are urged to report to German security agencies. Though no official attribution is given, authorities strongly suspect a state actor behind the campaign, as targets include politicians, military personnel, and journalists across Europe. The incident underscores ongoing cyber threats against key societal actors in the European context.