Russian intelligence hijacks Signal accounts via device-linking phishing across Europe

On 4 September 2026 Czechia's cyber agency NÚKIB published an analysis and recommendations. It warned that actors linked to Russia are taking over Signal accounts by tricking users into linking an attacker's device or revealing their PIN, using fake 'support' messages, malicious links and fraudulent group-invitation QR codes. NÚKIB cited cyber incidents connected with the app in Czechia. Its analysis (dated 11 Aug 2026) says such attacks have hit users in Ukraine, Germany, France and the Netherlands, and that the scope is very likely wider. An English version followed on 13 Oct 2026. Earlier, the Dutch AIVD/MIVD (9 Mar 2026) attributed the campaign to Russian state hackers, and the FBI and CISA (March 2026) to actors associated with the Russian Intelligence Services; the FBI/CISA alert reports unauthorised access to thousands of accounts.

Established by. NÚKIB analysis 'Ruské zpravodajské služby cílí na uživatele aplikace Signal' (č. j. 21670/2026-NÚKIB-E/630, 11 Aug 2026, TLP:CLEAR): the method was one that 'ruské zpravodajské služby pravděpodobně (55–70 %) poprvé nasadily vůči členům ukrajinské armády' ('Russian intelligence services probably (55–70%) first deployed against members of the Ukrainian army'). NÚKIB notice (4 Sep 2026): 'Tyto aktivity jsou spojovány zejména s aktéry napojenými na Ruskou federaci' ('These activities are mainly linked to actors connected to the Russian Federation'). AIVD/MIVD (9 Mar 2026): 'Russian state hackers are engaged in a large-scale global cyber campaign'; 'targets and victims of the campaign include Dutch government employees'. FBI/CISA PSA I-032026-PSA: 'cyber actors associated with the Russian Intelligence Services (RIS)'; 'This global campaign has resulted in unauthorized access to thousands of individual CMA accounts.'

Latest. The attacks abuse legitimate Signal features; the encryption is not broken. On 13 Oct 2026 NÚKIB re-issued the warning in English, with the analysis translated (ref. 24019/2026-NÚKIB-E/630, 30 Sep 2026). NÚKIB recommends checking linked devices regularly, enabling Registration Lock, never sharing a PIN or codes, and downloading Signal only from signal.org.

Link to the war against Ukraine. NÚKIB assesses that Russian intelligence services probably (55–70%) first used the technique against members of Ukraine's armed forces before turning it on European targets.