Berlin– The German government suspects Russia is behind a series of phishing attacks on Signal targeting high-ranking politicians, including two government ministers, military personnel and journalists, a government spokesman said.
Federal prosecutors are conducting a preliminary investigation into alleged cyberattacks on Signal accounts dating back to mid-February 2026, a spokesperson for federal prosecutors confirmed on Saturday.
Among other things, the investigation involves preliminary suspicions of espionage, he said, without specifying which country might be involved.
The German government has still not officially held Russia responsible for these attacks.
Pressure has increased on Germany and other European countries Cyber ​​attacks and other malicious activity Russia has been linked by Western officials since Moscow’s full-scale invasion of Ukraine in February 2022.
German magazine Der Spiegel, citing government sources, reported that about 300 Signal accounts belonging to individuals across the political spectrum were compromised in the attacks.
There has been no official confirmation of the names of the victims.
According to Der Spiegel, targeted users received messages from a fake Signal security chatbot that informed them of suspicious activity on their accounts and asked them to take immediate action. If users follow instructions, including entering a PIN or scanning a QR code, their Signal accounts are linked to an external device controlled by the hackers.
This allowed attackers to read past chats, follow ongoing conversations, and even view address books and other data stored by users.
In February, Germany’s domestic intelligence service BfV and federal cybersecurity authority BSI issued a public warning about such a phishing campaign, saying it was “likely being carried out by a state-controlled cyber actor.” According to German press agency dpa, German officials personally contacted several politicians to warn them that such attacks could occur.
In March, Dutch intelligence and security services also warned that “Russian state hackers are engaged in a large-scale global cyber campaign to gain access to Signal and WhatsApp accounts belonging to dignitaries, military personnel and civil servants.”
Targets include Dutch government employees, Dutch officials warned at the time, and journalists may also be targeted.
The Russian Embassy in Berlin did not respond to the AP’s request for comment. Moscow has repeatedly denied that it is spying on other countries.
German Ambassador to Russia Alexander Graf Lambsdorff was summoned to the Russian Foreign Ministry on Monday morning in connection with alleged contacts between German politicians and terrorist organizations, dpa reports. No connection has been made between the subpoenas and German media revelations about Signal phishing attacks.
Lambsdorff already said, “Of course, I will comply with the subpoena. I think the Russian side will not be able to prove its allegations.” Relations between the two countries have been tense for years.
———
Ciobanu reported from Warsaw, Poland.
