Signal phishing campaign targets Germany’s Bundestag President Julia Klöckner

Pierluigi Paganini
April 24, 2026

Germany’s Bundestag President Klöckner was targeted in a Signal phishing attack via a fake CDU group chat.

Germany’s Bundestag President Julia Klöckner has reportedly become the latest European political figure targeted through a Signal-based phishing attack, reported Der Spiegel. The incident is another reminder that even trusted messaging apps can become entry points when attackers go after the person, not the platform.

The attack targeted Klöckner’s phone through a Signal group chat linked to CDU officials. Chancellor Friedrich Merz was reportedly included but not compromised, and at least one other CDU lawmaker was also affected.

“Chancellor Friedrich Merz is also part of the group, although German domestic intelligence reportedly found no evidence his phone had been compromised. Der Spiegel also reported that at least one other CDU lawmaker was affected.” reported Politico.

What makes this case notable is not just the target, but the method. Attackers did not need to break Signal’s encryption. Instead, they appear to have used a phishing-style technique to trick users into revealing sensitive information, including PIN codes. That is a classic example of how cybercriminals often bypass strong technology by exploiting human trust.

The timing is also important. European cybersecurity and intelligence agencies had already warned earlier this month about a campaign in which attackers posed as a fake Signal support chatbot. The goal was simple: lure users into handing over authentication details. Germany’s domestic intelligence service had issued a similar warning in February, which shows that the threat was already known before this incident surfaced.

This matters because Signal has long been viewed as a secure communications tool. The European Commission has recommended since 2020 that officials use it for non-work communication. But secure design does not protect against account takeover, social engineering, or device compromise. If an attacker can get access to the phone number, the verification code, or the PIN, the app’s underlying security can be undermined.

The broader lesson is that messaging apps are only one layer of protection. Security now depends on the entire chain: the device, the account, the recovery process, and the user’s ability to spot deception. A secure app can still be weakened by weak endpoint hygiene, reused credentials, or a convincing fake support message.

For public officials, the risks are even higher. Their communications can expose political strategy, internal discussions, and personal details that attackers can later use for fraud, espionage, or influence operations. That makes identity protection and device hardening just as important as encryption.

Organizations and public bodies should treat this as a warning for their own staff. Any app used for sensitive communication should be backed by strong mobile security controls, phishing awareness, and rapid incident response procedures. Staff should be trained to ignore unsolicited support messages, verify any request through a separate trusted channel, and report suspicious account activity immediately.

There is also a governance issue here. If officials are encouraged to use secure consumer apps for private communication, those apps need to be protected by clear policies on device enrollment, PIN management, and recovery settings. Otherwise, the security benefit is only partial.

The key point is simple: modern attacks often succeed by attacking trust, not encryption. This case shows how a well-designed app can still become part of a compromise when users are deceived into giving away access. For governments and enterprises alike, the answer is not to abandon secure messaging, but to pair it with stronger identity controls, better training, and faster detection of phishing attempts.

In March, a cyberattack targeting Signal and WhatsApp users hit high-ranking German officials, including former BND Vice President Arndt Freytag von Loringhoven. The official reported being contacted by someone posing as Signal support and asked for his PIN. This incident highlights a broader cyber espionage campaign against sensitive individuals in security agencies and political positions.

“He is far from the only prominent victim of the global wave of attacks against user accounts at Signal and WhatsApp. According to SPIEGEL, high-ranking German politicians have reported themselves to the authorities as victims, and active officials in security agencies have also been attacked.” reads the report published by SPIEGEL. Back in February, the Federal Office for the Protection of the Constitution (BfV) and the Federal Office for Information Security (BSI) classified the attack as “security-relevant” and urged those affected to come forward. The BfV stated that this warning met with a “high response” and that they believe it prevented even worse damage.”

German authorities warned Signal users to check for suspicious signs, such as unknown devices listed under “paired devices” or unexpected prompts to re-register accounts.

In the case of former BND official Arndt Freytag von Loringhoven, attackers used his compromised account to send a malicious link to contacts. He quickly warned them not to open it and deleted his account. Investigators believe the incident is part of ongoing hybrid campaigns linked to Russia. Given Loringhoven’s work on Russian hybrid warfare and his book Putin’s Attack on Germany, he was likely considered a high-value target.

Signal warned that the attacks rely on social engineering, with attackers posing as trusted contacts or fake support services to trick users into sharing verification codes or PINs. The company stressed it will never ask for these details via messages or social media and urged users to stay vigilant and never share login codes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon