What the Attack Looks Like
Threat actors combine social engineering with legitimate Signal features to steal data from politicians, military officers, diplomats and investigative journalists across Germany and Europe. They contact the target directly, pretending to be members of Signal’s support team or a support chatbot, and create a sense of urgency with a fake security warning.
Two Main Attack Variants
- Support‑impersonation attack: Victims receive a message that appears to come from Signal support, urging them to share their Signal PIN or an SMS verification code. The code lets the attacker register the victim’s account on a device they control, hijack the account and lock the legitimate user out.
- QR‑code pairing technique: Inspired by a method reported by Google researchers, Russian‑state‑aligned groups such as Sandworm use malicious QR codes to pair a victim’s account with an attacker‑controlled device, bypassing the PIN requirement.
Why the PIN and SMS Code Matter
The Signal PIN is essential for registering the account on a new device. Without it, registration fails. If the PIN is disclosed, the attacker can duplicate the account, access one‑to‑one and group chats, and harvest contact lists. Losing the PIN can also lock the legitimate user out of their own account.
Recommendations from German Authorities
- Never reply to unsolicited messages claiming to be from Signal support; the platform never contacts users directly.
- Block and report any suspicious “support” accounts immediately.
- Never share your Signal PIN or SMS verification code with anyone, even if the request appears urgent.
- Enable additional device‑level security measures, such as biometric locks, to reduce the impact of a compromised PIN.
Automating Incident Response with Tines
The new Tines guide shows how security teams can reduce hidden manual delays by automating the detection, containment and reporting of these phishing attempts. By integrating existing tools (email gateways, SIEMs, ticketing systems) into intelligent workflows, organizations can quickly block malicious accounts, alert affected users, and gather forensic evidence without manual overhead.