German Prosecutors Open Formal Espionage Case as Signal Phishing Campaign Compromises 300+ Political Accounts
German federal prosecutors opened a formal espionage investigation on April 24 based on initial suspicion of espionage. Der Spiegel reported at least 300 accounts belonging to political figures were compromised. Targets include the
The attack methodology exploits Signal's device-linking protocol rather than its encryption: spoofed support messages solicit PINs and QR codes that link attacker-controlled devices, preserving cryptographic integrity while bypassing it operationally. Converging reporting anchored by Der Spiegel's 300-plus compromised accounts across parliamentarians, diplomats, military, and journalists elevated this from targeted phishing to one of the most extensive Russian intelligence operations against a NATO parliament disclosed in recent years. Prosecutors' April 24 escalation to formal espionage investigation, beyond the cybersecurity-incident framing, formalized that assessment. Formal attribution to a specific Russian service is unlikely within 30 days: forensic material is substantial, but German prosecutors will likely prioritize the investigation over public attribution. Von Notz's acknowledgment that communications integrity can no longer be guaranteed makes Bundestag restrictions on Signal desktop on parliamentary systems likely, with downstream implications for secure legislative communications across NATO. The campaign's breadth may instead indicate an automated or semi-automated operation rather than bespoke intelligence collection, which would lower assessments of operational sophistication and narrow the probable perpetrator set.