Fake Signal support messages target European politicians, military personnel and journalists
German and Dutch authorities warned that fake 'Signal support' messages and booby-trapped QR codes are being used to hijack Signal and WhatsApp accounts of officials, military and journalists.
Never share a Signal PIN, SMS code or recovery key with anyone, including 'Signal Support'. Open Signal's Settings, then Linked Devices, remove any device you don't recognise, turn on Registration Lock, and keep the app updated.
What’s happening
On 6 February 2026 German security authorities warned of a suspected state-sponsored campaign against high-profile Signal users in Europe, including politicians, military personnel and journalists. Attackers pose as Signal support or a 'security chatbot', claim suspicious activity, and ask for the victim's SMS code or Signal PIN. With those they can register the account on their own device and read new messages, or send messages as the victim. A second method uses malicious QR codes or links, disguised as group or contact invitations, that quietly link the attacker's device to the account while the victim keeps working access. On 9 March the Dutch AIVD and MIVD confirmed Dutch government employees were targeted, and BleepingComputer reported Russian state-linked hackers had been tied to the campaign, without published evidence. This is a scam rather than a software flaw, so there is no patch. In May 2026 Signal added warning labels and prompts against impersonators. Signal never asks for codes, PINs or recovery keys.
- What
- Scam
- Affects
- Signal messaging app (also WhatsApp linked-device abuse)
- Fixed in
- Nothing to patch
- Since
- 6 Feb 2026
- Closed
- 12 May 2026
Timeline
- New fix
Signal added in-app protections against impersonators: a 'Name not verified' label, a 'No groups in common' notice on message requests, an extra prompt when accepting requests from unknown senders, and expanded Safety Tips. Signal said more changes were coming.
- Wider attacks
The Dutch intelligence services AIVD and MIVD issued an advisory confirming Dutch government employees were targeted, and Signal publicly acknowledged the attacks. The advisory described a fake Signal security chatbot asking for SMS codes or PINs, plus malicious QR codes and links that silently link an attacker's device to Signal or WhatsApp accounts. BleepingComputer reports Russian state-sponsored hackers have been linked to the campaign, without detailing the evidence.
- Update
CERT-EU's February cyber brief listed the Signal support-bot phishing among the month's main campaigns. It noted its attributions reflect public reporting and are not CERT-EU's own position.
- Made publicNothing to patch
German security authorities warned of a suspected state-sponsored campaign in which fake Signal support accounts urged high-profile users across Europe, including politicians, military personnel and journalists, to hand over PINs or re-register their accounts. CERT-EU records the warning as reported on 6 February and advises recipients to contact Germany's BfV or BSI.
Sources
- CERT-EU Cyber Brief 26-03 (February 2026)CERT-EU · 2 Mar 2026
- Dutch govt warns of Signal, WhatsApp account hijacking attacksBleepingComputer · 9 Mar 2026
- Signal rolls out new protections against impersonation attacksCyberInsider · 12 May 2026