Russia Compromised Signal Accounts in Five NATO Nations; Czech Republic Confirms Breach

The Czech Republic's National Cyber and Information Security Agency (NÚKIB) issued a formal threat analysis on Tuesday warning that actors tied to the Russian Federation are running targeted phishing campaigns against Signal users across Europe and confirming that related incidents have now occurred inside the Czech Republic itself.

Tuesday's advisory makes NÚKIB the fifth Western intelligence or cybersecurity agency to publicly corroborate and formally attribute the same operation — joining Dutch, German, American, and Ukrainian counterparts who have sounded the same alarm over the preceding eight months. Every one of those agencies has confirmed the same central finding: Signal's end-to-end encryption has not been broken. The weapon is not mathematics. It is the moment a target scans a QR code without looking closely enough.

The operation's scope is larger than any public accounting has captured. The FBI reported in March 2026 that unauthorized access reached thousands of Signal accounts worldwide. In Germany alone, approximately 300 accounts in the political sphere were compromised, per reporting by Der Spiegel citing governmental sources on the investigation .

Dutch government employees were among confirmed victims, with the Netherlands' General Intelligence and Security Service (AIVD) stating that attackers had likely obtained access to sensitive information as a result. NÚKIB's advisory on Tuesday warns that the true geographic footprint is "almost certainly larger" than the five countries — Ukraine, Germany, France, Netherlands, and now Czech Republic — in which the technique has been officially documented.

Signal Encryption Is Intact — The Attack Goes Around It

The most important finding across all five national advisories is what the campaign does not do: it does not crack Signal's cryptography. The Signal Protocol — built on the Double Ratchet Algorithm and a key-exchange mechanism described in Signal's open technical specifications — has not been compromised. Decryption keys are generated on users' devices and never held by Signal's servers, which means even a full breach of Signal's infrastructure would yield no readable message content.

Instead, threat actors exploit a convenience feature that ships in every copy of Signal: the ability to link a single account to multiple devices simultaneously. When a user links a secondary device — a laptop, for instance — their phone displays a QR code. Any device that scans that code is paired to the account and receives every incoming and outgoing message in real time. The attack replaces that legitimate QR code with a malicious one that pairs the account to attacker-controlled infrastructure .

Google's Threat Intelligence Group (GTIG) documented this technique in early 2025 and noted a structural problem that makes it particularly difficult to detect: Signal does not maintain centralized server-side logs of device-pairing events. That is not an oversight — it reflects Signal's deliberate architectural choice to minimize metadata retention, preserving user privacy by not recording which devices have been linked to which accounts. The same design that protects metadata from bulk collection also means neither Signal's servers nor the user's account dashboard provides a reliable audit trail of new pairings. According to GTIG, compromises established this way "can go unnoticed for extended periods of time."

Four Simultaneous Russian Intelligence Clusters, Each with Distinct Malware

What distinguishes this campaign from a single-actor phishing operation is the number and diversity of the threat groups confirmed to be running parallel attack architectures against the same target population. GTIG attributed distinct operational tracks to at least four named clusters, each with documented state intelligence ties .

APT44 (Sandworm, GRU Unit 74455) — Russia's military intelligence directorate, known previously for the NotPetya ransomware and attacks on Ukraine's power grid — has deployed malicious QR codes to silently pair Signal accounts on captured or battlefield-compromised devices in Ukraine. Its Infamous Chisel Android malware is designed to extract Signal's encrypted database files from compromised Android devices. A script designated WAVESIGN periodically repeats this extraction to capture new messages over time.

UNC5792 — which overlaps with the group Ukraine's CERT-UA tracks as UAC-0195 — operates by hosting modified Signal group invitation pages on actor-controlled infrastructure. The page is visually indistinguishable from a legitimate Signal group join screen, but the QR code encodes a device-linking URI ( sgnl://linkdevice ) pointing to the attacker's infrastructure rather than a group invitation. Victims who scan the code pair their account to the attacker silently and without an obvious warning.

UNC4221 — tracked by CERT-UA as UAC-0185 — targeted Ukrainian military Signal users with a phishing kit that mimicked Kropyva, a specialized artillery guidance application used by Ukrainian armed forces. Malicious QR codes inside the kit completed device pairings on behalf of the attacker.

Turla (FSB Center 16) — one of Russia's most sophisticated and long-running advanced persistent threat actors, also known as Snake and Venomous Bear — used PowerShell scripts to exfiltrate Signal messages and database content from compromised Windows machines. Turla specializes in sustained, undetected access to high-value government, military, and diplomatic targets; its operational footprint in this campaign follows that historical pattern.

A fifth cluster, UNC1151 , assessed as linked to Belarusian state intelligence, employed the Windows Robocopy utility to copy desktop Signal database files from compromised machines — a notably low-tech but effective approach that bypasses Signal's encryption by accessing the already-decrypted local database.

The convergence of GRU, FSB, and Belarusian intelligence assets against the same application and target population represents an unusual level of coordinated intelligence-community interest in a single communications platform.

How the Phishing Works in Practice

NÚKIB describes two primary attack vectors, both exploiting user behavior rather than any weakness in Signal's underlying protocol.

Linked-device phishing. An attacker with the victim's phone number sends a message crafted to appear as a legitimate Signal notification — a support alert, a security warning, or a group invitation. The embedded link or QR code, when followed, completes Signal's legitimate device-pairing flow, but in favor of attacker-controlled infrastructure. The process leaves no visible alert to the victim and requires no further action from the attacker to maintain ongoing access.

Malicious group invitations. UNC5792 has been observed substituting the redirect code in legitimate Signal group invite pages with links pointing to actor-controlled domains. In spear-phishing campaigns against Ukrainian military personnel, these QR codes were embedded inside pages mimicking specialized military applications used by the Ukrainian armed forces — meaning the victim believed they were completing a routine operational step.

Both variants are sometimes combined with requests for the victim's Signal PIN, framed as account verification or security recovery. Once a foothold is established, the attacker gains the ability to read messages, access lists, and impersonate the compromised account in further phishing attacks directed at the victim's established network of colleagues, officials, and trusted contacts — propagating the intrusion laterally through relationships that already carry institutional trust.

A Formally Confirmed Multi-Country Operation

Tuesday's NÚKIB advisory is the latest point in a sequence of official alerts that extends back to early 2025, when GTIG first publicly documented the device-linking technique. The campaign accumulated formal Western government visibility progressively over the following year.

In February 2026, German federal prosecutors launched a preliminary investigation into cyberattacks on Signal accounts , with espionage listed among the initial areas of suspicion. Targets included two unnamed government ministers, military personnel, and journalists. Der Spiegel, citing governmental sources, reported that approximately 300 Signal accounts in the German political sphere were compromised, with one attack vector involving a fake chatbot used to trick officials into revealing Signal registration credentials.

On March 9, 2026, the Netherlands' AIVD and MIVD issued a joint advisory formally attributing the campaign to Russian state actors — the first formal European intelligence attribution. AIVD Director-General Simone Smit drew a distinction that has since become the consistent messaging across all allied advisories: "It is not the case that Signal or WhatsApp as a whole have been compromised. The threat concerns the accounts of individual users."

The Dutch advisory's second significant contribution came from MIVD Director Vice-Admiral Peter Reesink, who stated publicly that even end-to-end encrypted messaging applications are not appropriate for classified government information. That position has since been echoed by advisories from Germany, the United States, and now the Czech Republic.

On March 20, 2026, the FBI issued a public service announcement formally attributing the campaigns to Russian intelligence services. The bureau stated that the vulnerability "lies not in the applications themselves but in how users respond to increasingly sophisticated social engineering" and reported that the activity had led to unauthorized access to thousands of accounts worldwide.

Registration Lock: Signal's Existing Counter-Measure

Signal's Registration Lock is the most significant existing mitigation against the device-registration class of attacks — and it is disabled by default .

Registration Lock requires users to set a PIN that must be entered before any new device can be registered to a phone number. When enabled, an attacker who obtains a victim's phone number — through SIM-swapping, social engineering, or other means — cannot complete a device registration without also possessing the PIN. The 2022 Twilio breach, in which attackers briefly re-registered approximately 1,900 users' phone numbers on attacker-controlled Signal instances, demonstrated both the viability of this attack vector and the protection Registration Lock provides when enabled.

The linked-devices attack documented in Tuesday's advisory differs from a full account re-registration — it exploits the device-pairing flow rather than the account-creation flow — but Registration Lock still raises the cost of several related attack paths. Taken together with regular audits of the Linked Devices list, it remains the highest-leverage single action most Signal users can take today.

In September 2025, Signal launched Secure Backups — a zero-knowledge encrypted cloud backup system secured by a 64-character recovery key generated on the user's device. The key is never transmitted to Signal's servers, meaning Signal cannot recover it and cannot be compelled to provide it. The Secure Backups feature closes a separate gap — the risk that an attacker who obtains a device-recovery backup could read historical messages — and does not directly address the device-pairing phishing technique, which operates against the live account rather than its backup.

What NÚKIB Recommends

NÚKIB's advisory pairs its threat analysis with concrete hardening steps, published alongside a full technical document and prioritized for individuals in government, security, diplomatic, or political roles. Its core guidance:

Audit linked devices regularly. In Signal, navigate to Settings → Linked Devices and immediately remove any device you do not recognize. Any unfamiliar entry should be treated as a potential compromise requiring further investigation .

Enable Registration Lock. Found at Settings → Account → Registration Lock, this feature requires a PIN before new registration , blocking account takeover attempts even when an attacker holds the victim's phone number.

Treat all unsolicited "Signal support" messages as fraudulent. Signal's official support does not users through the application itself, and it will never request a PIN or registration credentials via in-app message.

Do not scan unsolicited QR codes or follow unrequested links , regardless of how legitimate the invitation or notification appears. QR codes presented in a messaging context should be verified out-of-band before scanning.

Use disappearing messages for sensitive conversations, and restrict account discoverability via phone number in Signal's privacy settings.

Download Signal exclusively from signal.org. Trojanized builds of the application have been documented in related campaigns; unofficial distribution channels must not be used under any circumstances .

The sustained targeting of Signal across five NATO-member countries is significant precisely because Signal is widely regarded as the most cryptographically rigorous consumer messaging application currently available for broad civilian and governmental use. Its adoption by governments, militaries, intelligence services, journalists, and civil society organizations — the exact populations now confirmed as primary targets — reflects the genuine strength of its cryptographic protocol. The current campaign underscores the limits of that strength when the attack surface is human behavior rather than mathematics.

Security officials from multiple allied nations have now formally concluded that encrypted messaging applications, including Signal, are not adequate for classified government communications. That represents a notable and explicit shift from a period, not long ago, when Signal was the de facto recommendation for sensitive official use in several of those same governments. NÚKIB's advisory on Tuesday lands at a moment when that institutional consensus is hardening into official policy, and when the campaign's operational footprint has demonstrably extended from active conflict zones in Ukraine into the ministries, parliaments, and intelligence services of Western Europe's established democracies.

NÚKIB's full technical analysis and phishing mitigation document are publicly available at nukib.gov.cz.

Key Facts at a Glance

Frequently Asked Questions

Has Signal been hacked? Is it safe to use?

Signal's end-to-end encryption has not been compromised. Every allied agency advisory — from the Netherlands' AIVD and MIVD to the U.S. FBI to Tuesday's NÚKIB advisory — confirms explicitly that Signal's cryptographic protocol remains intact. The attacks succeed by tricking users into voluntarily linking an attacker-controlled device to their account, not by breaking the encryption protecting messages in transit. Signal remains among the most secure consumer messaging applications available; the risk is in how users respond to phishing attempts, not in the application's underlying design.

Why can't Signal alert me when my account is silently mirrored to a new device?

This is the structural tension at the center of the campaign. Signal's architecture deliberately avoids retaining metadata — including logs of which devices have been paired to which accounts — because that metadata is itself sensitive and could be compelled from Signal's servers by government demands. The same privacy design that prevents Signal from being forced to hand over device-pairing records also means Signal cannot proactively alert users through a centralized server-side audit trail. Users must audit their own Linked Devices list manually in the Signal application (Settings → Linked Devices) and must enable Registration Lock to raise the cost of unauthorized device registrations. Signal's more recent software updates have improved the visibility of the Linked Devices panel, but the architectural tradeoff between privacy and detectability remains.

What is Signal Registration Lock and how do I turn it on?

Registration Lock is Signal's built-in multi-factor authentication feature for account registration. When enabled, a user-set PIN is required before any new device can be registered under a given phone number. This blocks account-takeover attacks that depend on the attacker having only the victim's phone number — including SIM-swap attacks and some social engineering scenarios. To enable it: open Signal → Settings → Account → Registration Lock, then toggle it on and set a strong PIN you will remember. Store the PIN securely; if lost, Signal provides a seven-day grace period followed by an account lock until the original PIN is recovered. NÚKIB, the AIVD, the FBI, and GTIG all identify Registration Lock as the single highest-priority hardening step for at-risk users.

Which countries' Signal users are confirmed to have been targeted?

The five countries with formal government-level confirmation as of Tuesday, October 13, 2026, are Ukraine, Germany, France, the Netherlands, and the Czech Republic. Germany's federal prosecutors confirmed approximately 300 compromised accounts in the political sphere, including government ministers, military personnel, and journalists. Dutch intelligence confirmed government employees among victims. The FBI's March 2026 advisory assessed that thousands of accounts worldwide had been compromised, and NÚKIB's Tuesday advisory warns the true geographic footprint is "almost certainly larger" than the five countries named.