Germany Suspects Russia Behind Phishing Campaign Targeting Officials on Signal

BERLIN (AP) — The German government suspects Russian state hackers are behind a sophisticated phishing campaign targeting high-ranking politicians, military personnel, and journalists using the encrypted messaging app Signal.

Federal authorities confirmed the investigation on Monday, stating that the attacks appear to be part of a broader state-sponsored cyber espionage effort aimed at extracting sensitive information from key figures within the German political and defense sectors. The campaign, which has been ongoing for several months, involves deceptive messages designed to trick recipients into clicking malicious links that grant attackers access to their devices.

The targeted individuals include members of the Bundestag, senior officers in the Bundeswehr, and reporters covering national security and foreign policy. Security officials described the operation as highly coordinated, noting that the phishing messages were tailored to the specific interests and recent activities of the victims.

Germany’s Federal Office for Information Security (BSI) has issued urgent warnings to affected organizations and individuals, advising them to change passwords, enable two-factor authentication, and report any suspicious activity. The agency has also recommended that government officials exercise extreme caution when receiving messages from unknown senders, even if they appear to originate from trusted contacts.

Russian officials have not commented on the allegations. Moscow has previously denied involvement in similar cyber operations against Western governments, often dismissing such accusations as politically motivated. However, the German government has long accused Russia of conducting cyber espionage and disinformation campaigns aimed at destabilizing democratic institutions in Europe.

The Signal messaging platform, known for its end-to-end encryption, has not been compromised in the technical sense. Instead, attackers are exploiting human error by sending fraudulent messages that mimic legitimate communications. Once a victim clicks a malicious link, malware is installed on their device, allowing remote access to messages, contacts, and other sensitive data.

Cybersecurity experts warn that the use of encrypted platforms does not eliminate the risk of phishing attacks. They emphasize that user vigilance remains the first line of defense against such threats. The German government is working with international partners to trace the origin of the attacks and identify the specific threat actors involved.

As the investigation continues, questions remain about the full scope of the campaign and whether any sensitive information has already been exfiltrated. Authorities have not disclosed whether any data was successfully stolen or if the attacks were detected before significant damage occurred. The incident highlights the growing challenge governments face in protecting digital communications from state-sponsored adversaries.

Federal officials indicated that further updates would be provided as more details become available. In the meantime, they are urging all citizens and organizations to remain alert to potential cyber threats and to follow established security protocols.