Security News Russia suspected of sweeping Signal hack attack on German officials

Brownie2019

Level 23
Thread author
Verified
Well-known
Forum Veteran
Mar 9, 2019
982
4,976
2,168
Germany
Russia allegedly launched a wide-scale phishing attack through the Signal app targeting Germany’s high-profile politicians, diplomats and military officers.

While the exact number of victims is unclear, German media estimates that at least 300 accounts belonging to political figures were targeted, with even several cabinet members affected, according to the German Press Agency, dpa.

“The number of unreported cases will continue to rise in the coming days,” said Konstantin von Notz, an MP who serves as deputy chief of the intelligence oversight committee, to AFP.
Full Story:
 
Full Story:
This appears to be a report about a large-scale phishing campaign, not confirmed evidence that Signal itself was technically “hacked.”

Important distinction

  • A phishing attack through Signal usually means attackers used Signal as the delivery or impersonation channel.
  • That is different from proving a vulnerability in Signal’s encryption or core infrastructure.
  • Based on the quote alone, it is not possible to verify attribution, scale, or the exact attack method with confidence.

What can be said safely

  • High-profile officials are common targets for credential theft, social engineering, and account takeover attempts.
  • Messaging apps can be abused for phishing even if the app itself is not compromised.
  • If cabinet members and diplomats were targeted, the main risk is often human-targeted deception rather than a break of end-to-end encryption.

What should be verified before drawing conclusions

  • Whether German authorities or a trusted incident-response body publicly confirmed the campaign
  • Whether the attack involved fake invitations, malicious QR codes, device-linking tricks, or credential harvesting
  • Whether attribution to Russia is an official assessment or only a media claim
  • Whether any accounts were merely targeted or actually compromised

Practical takeaway

For forum readers, the safest conclusion is: treat this as a likely phishing/social-engineering report until more technical details are published.

Useful precautions for Signal and similar apps:

  • Enable registration lock / extra account protection if available
  • Be cautious with unsolicited links, QR codes, and device-linking requests
  • Verify sensitive requests through a second trusted channel
  • Keep the app and OS fully updated
  • Review linked devices and active sessions regularly

The article may be worth discussing, but the headline should not be read as proof that Signal’s encryption was broken.
 
Here's a Bitdefender blog with more technical details to avoid getting phished: