Was the Signal app itself hacked or its encryption broken?

No. The core end-to-end encryption of Signal was not compromised. The attackers used a social engineering technique called phishing to trick users into giving up their SMS verification codes, which allowed for an account takeover.

What is a Registration Lock in Signal?

Registration Lock is a security feature that requires you to enter a personal PIN, which you create, in addition to the standard SMS verification code when registering your phone number on a new device. It effectively blocks the type of account takeover seen in this attack.

Who was targeted in this phishing campaign?

The primary targets were high-ranking German officials, including several members of the Bundestag (the German parliament) and opposition leaders. This indicates the goal was likely political espionage.

Why do German authorities suspect Russia is behind the attacks?

While official evidence is part of an ongoing investigation, the suspicion is based on the attack's sophistication, the high-profile political targets, and its alignment with a well-documented history of Russian state-sponsored cyber espionage against German political institutions, such as the 2015 Bundestag hack.

How can I protect my own Signal account?

The most important step is to enable Registration Lock in your Signal settings (Settings > Account > Registration Lock). Additionally, never share verification codes received via SMS with anyone and be suspicious of any unsolicited messages asking you to click links or provide information.

Germany suspects Russia is behind Signal phishing that targeted top officials

Berlin on High Alert as Encrypted Communications Come Under Attack

Germany’s federal prosecutors have opened a preliminary investigation into a sophisticated phishing campaign that targeted the Signal accounts of high-ranking German officials. The attacks, which occurred in late 2023 and early 2024, are suspected to be the work of nation-state actors with links to Russia, marking another significant escalation in the ongoing cyber conflict between the two nations.

The campaign did not exploit a flaw in Signal’s renowned end-to-end encryption but instead relied on classic, albeit well-executed, social engineering to trick targets into handing over account access. This incident serves as a stark reminder that even the most secure communication platforms can be undermined by targeting the human element.

Background: A Pattern of Espionage

This is not the first time Germany has pointed the finger at Moscow for cyber intrusions. The most infamous precedent is the 2015 hack of the German Bundestag (parliament), an attack attributed to the Russian state-sponsored group APT28, also known as Fancy Bear. That breach resulted in a massive data leak and significantly strained diplomatic relations. Since then, German intelligence agencies have consistently warned of ongoing Russian espionage and influence operations aimed at destabilizing German politics and society (SecurityWeek, 2024).

The current attacks fit squarely into this established pattern. By targeting the private communications of politicians, including members of parliament and opposition leaders, the perpetrators sought access to sensitive discussions, strategic planning, and personal information that could be leveraged for intelligence gathering or coercion. The choice of Signal as a target is also revealing; as officials move to secure platforms for confidential dialogue, adversaries are adapting their tactics to follow them.

Technical Details: The Social Engineering Trap

The threat actors did not break Signal’s cryptographic protocol. The platform’s core security, which protects the content of messages in transit, remained intact. Instead, the attackers focused on a well-known weak point in many online services: account registration and verification via SMS.

The attack unfolded through a multi-step process designed to manipulate the target:

Initiation: The attacker begins the process of registering the target’s phone number with the Signal app on a device they control.
Legitimate Verification: As designed, Signal’s system automatically sends a six-digit verification code via SMS to the legitimate owner of the phone number—the targeted official.
The Phishing Lure: Almost simultaneously, the attacker sends a separate, fraudulent message to the target. This message is carefully crafted to create a sense of urgency or legitimacy. It might impersonate Signal’s support team, warning of a security issue, or appear to come from a trusted contact. The message prompts the user to enter the verification code they just received into a malicious link or reply with the code to “secure their account.”
Account Takeover: If the target falls for the ruse and reveals the verification code, the attacker enters it on their device. This completes the registration process, effectively hijacking the Signal account. The attacker gains control of the account on their new device, allowing them to receive all new incoming messages and send messages impersonating the victim.

This method bypasses Signal’s robust encryption by simply taking over the account at the endpoint. Signal itself acknowledged this threat vector in a late February blog post, emphasizing that these were social engineering attacks and strongly advising users to enable a critical security feature to counter them (Signal, 2024).

Impact Assessment: Beyond Stolen Messages

The potential fallout from a successful compromise of a high-ranking official's Signal account is severe and multi-faceted.

Intelligence Loss: The primary goal of such an attack is espionage. Attackers could gain real-time insight into sensitive policy discussions, legislative strategies, international negotiations, and internal party politics. Access to a target's contact list alone provides a valuable map of their network for future targeting.
Disinformation and Influence: A compromised account is a powerful tool for spreading disinformation. An attacker could send messages impersonating the official to colleagues, journalists, or the public, potentially creating political scandals, sowing discord, or influencing public opinion.
Blackmail and Coercion: Access to private conversations, even if not state secrets, can provide ample material for blackmailing officials, thereby compromising their integrity and influencing their political actions.
Erosion of Trust: These attacks can undermine trust in secure communication tools, potentially causing officials to revert to less secure channels. It also damages diplomatic relations, further isolating Russia and prompting retaliatory measures from Germany and its allies.

The targets—members of parliament and opposition leaders—suggest a broad intelligence-gathering effort aimed at understanding the full spectrum of German political thought and potential vulnerabilities.

How to Protect Yourself

While this campaign targeted high-profile individuals, the techniques used are common in phishing attacks against the general public. Protecting your Signal account and other online services from this type of takeover is straightforward but requires proactive steps.

Enable Registration Lock Immediately: This is the single most effective defense against this attack. Registration Lock is a feature within Signal that requires a personal PIN to register your phone number on a new device. Even if an attacker tricks you into revealing your SMS verification code, they cannot complete the account takeover without your PIN. To enable it, go to Signal Settings > Account > Registration Lock and set a memorable PIN.
Treat Verification Codes Like Passwords: Never share SMS verification codes with anyone, for any reason. Legitimate companies like Signal will never ask you to send a code back to them or enter it on a third-party website. These codes are meant for you and you alone to enter directly into the official app.
Be Skeptical of Unsolicited Messages: Scrutinize any unexpected message that asks you to take urgent action, especially if it relates to account security. Look for unusual phrasing, grammatical errors, or suspicious links. Do not click links in SMS messages from unknown or untrusted sources.
Enhance Overall Digital Security: Maintain good digital hygiene across all your devices and accounts. This includes using strong, unique passwords for different services, enabling two-factor authentication (2FA) wherever possible, and considering a comprehensive VPN service for an added layer of privacy protection when using public Wi-Fi.

The German case is a high-stakes demonstration of a universal truth in cybersecurity: technology can only provide protection up to a point. Vigilant, educated users remain the most critical line of defense against sophisticated adversaries.