Germany’s domestic intelligence agency has issued a warning about phishing attacks by suspected state-sponsored actors targeting high-ranking individuals via messaging apps like Signal. The security advisory is based on intelligence collected by the Federal Office for the Protection of the Constitution (BfV) and the Federal Office for Information Security (BSI). These attackers use social engineering, often posing as service support agents, to steal data from politicians, military officers, diplomats, and journalists across Europe, without exploiting technical vulnerabilities or using malware. Two (2) attack variants are noted: one (1) involves a full account takeover by tricking targets into sharing their Signal PIN or SMS verification code, allowing attackers to hijack the account. The other uses a QR code to pair the victim’s account with the attacker’s device, enabling chat monitoring. The attacks, observed on Signal and potentially applicable to WhatsApp, involve tactics previously used by Russian groups like Sandworm. CTIX Analysts recommend that users avoid responding to suspicious support messages, block and report such accounts, and enable Signal’s ‘Registration Lock’ for added security. Regularly checking linked devices and removing unfamiliar ones is also recommended to prevent unauthorized access.