Russians suspected of being behind attack Huge Signal hack - what you can do now

The German government suspects that Russia is behind attacks on the messenger Signal. What's behind it and what you should look out for.

Email inboxes, internet accounts, messenger apps - all of these can be hacked, with unpleasant consequences. And it can affect everyone, right up to top politicians, as happened to Signal this weekend. Bundestag President Julia Klöckner and two Merz ministers are said to have fallen victim to the attacks.

Blue circle suddenly disappearedWhat does this purple flower in WhatsApp do?

The German Federal Office for Information Security (BSI) and the Federal Office for the Protection of the Constitution therefore warn against the active phishing campaign and provide answers to the most important questions.

The attackers send messages that disguise themselves as official Signal messages. Typical patterns:

- Fake Signal chatbot: a message claims your account has been compromised - and asks you to enter your PIN or re-register.
- QR codes: A link or QR code leads to a fake Signal page. The fake URL may not be immediately apparent on the small cell phone display.
- Cloned AI voices and social engineering: Attackers also use hijacked accounts to exploit the trust of colleagues and contacts and target them.

Pass on your PIN, registration code or personal data to someone who pretends to be a support, security service or authority via Signal. Signal will never ask you for your PIN in this way.

Scenario 1: I received the message but did not respond

That's right. Nevertheless: Delete the message and block the sender. Then activate the registration lock or two-factor authentication (2FA).

Scenario 2: I have entered a code and/or PIN, but still have normal access to my Signal account and have not been forced to log in again

Then step 1: immediately change the Signal PIN via the app settings. Step 2: Delete your Messenger account via the settings in the app (caution: only delete the account, not the app!). Step 3: Create a new Messenger account with a new PIN.

It can be assumed that the attackers may now know your cell phone number - if you find this sensitive for certain reasons and want to be on the safe side, get a new mobile phone number in step 4 and register a new Messenger account with this number.

Step 5: Activate the registration lock, hide the mobile phone number and activate self-deleting messages wherever possible. Step 6: Report and block the alleged Signal support contact.

What's behind itReady for free - WhatsApp is now launching a "Plus" version

Scenario 3: I have entered an SMS code and/or PIN and can no longer access my account.

The worst case - the Messenger account is hacked. The attackers have then taken over the entire account, can view all messages and contacts and impersonate you.

Then: assign a new and previously unused Signal PIN via the app settings. Inform your contacts that all communications from the time of the attack have been read - use a different communication channel (e.g. telephone, email). The account that has been taken over must be blocked by your contacts.

This also applies to groups: The BSI advises to have all accounts as well as possible "deleted accounts" removed from all chat groups and to inform all group members to block the taken over account. It is strongly recommended that chat groups be deleted and recreated; invitation links must be recreated.

The following also applies here: If you want to be on the safe side, get a new mobile phone number and register a new Messenger account with it; and: Activate registration lock, hide mobile number and activate self-deleting messages wherever possible.

Then contact genuine Signal support to have the old "lost" account deleted.