From Ministers to Intelligence Officials as Victims: German Signal Phishing Scandal Implicates Foreign Agents

The German intelligence agency is investigating a large-scale phishing campaign targeting users of the Signal messaging app. The attack has even targeted high-ranking government officials and journalists, with suspicions of Russian involvement. According to reports from German media outlets such as Der Spiegel and DPA, several federal officials have fallen victim to the attack. Among them are Education Minister Karin Prien, Development Minister Verena Hubertz, and former deputy head of German foreign intelligence, Arndt Freytag von Loringhoven. Previously, Bundestag President Julia Klöckner was also reported to have been targeted. This incident adds to concerns over the security of communications for high-ranking officials in Germany. A spokesperson for the Ministry of Development stated that the ministry maintains strict standards regarding communication security. However, they emphasised that the ministry would not comment on any security incidents, whether actual or potential. Sources close to the security apparatus indicate that the number of victims reaches dozens. There are even indications that hundreds of phishing attempts have been made in this campaign, as reported by RTVI. Unconfirmed reports suggest that at least 300 Signal accounts belonging to political figures have been successfully hacked. This demonstrates the broad and organised scale of the attack. A German government source told Der Spiegel that the attack was “most likely carried out from Russia”. However, there has been no official confirmation from the authorities to date. All identified victims have been notified by the security authorities. Affected devices have also been examined to ensure that data leaks can be stopped. Experts assess that this attack did not exploit technical vulnerabilities in the Signal app. Instead, the perpetrators exploited human weaknesses through social engineering techniques. In the method used, victims received messages that appeared to come from Signal’s technical support. These messages asked users to enter their PIN, open a link, or scan a QR code. If victims followed the instructions, the perpetrators could access conversations, photos, and personal files. They could even act on behalf of the victim in group conversations.