The Czech Republic's National Cyber and Information Security Agency (NÚKIB) published a formal threat analysis on Tuesday, 13 October 2026. It warns that actors tied to the Russian Federation, attributed to the GRU and FSB, are running targeted phishing campaigns against Signal users across Europe. NÚKIB also confirms that related incidents have now happened inside the Czech Republic. According to TechTimes, NÚKIB is the fifth national intelligence or cybersecurity body to publicly corroborate and attribute the operation, after Dutch, German, American and Ukrainian counterparts over the past eight months. All of them reach the same central finding: Signal's end-to-end encryption was not broken. The attackers trick targets into scanning QR codes that silently link an attacker-controlled device to the victim's account. The FBI reported in March 2026 that unauthorized access reached thousands of Signal accounts worldwide. In Germany, Der Spiegel puts the figure at about 300 accounts in the political sphere, citing government sources.
What Happened
The campaign uses a legitimate Signal feature to take over accounts. TechTimes reports that NÚKIB's advisory names five countries where the technique has been officially documented: Ukraine, Germany, France, the Netherlands and now the Czech Republic. The advisory says the real geographic footprint is "almost certainly larger."
Two points in the reporting don't line up and are worth flagging:
- "Five NATO countries" is not quite accurate. The incident framing describes five NATO nations, but Ukraine is on the documented list and is not a NATO member. A more accurate description is four NATO members plus Ukraine.
- Countries and agencies don't match. The five agencies TechTimes credits with corroborating the campaign are Dutch, German, American, Ukrainian and Czech. The five countries with documented compromises include France and leave out the US. The available reporting doesn't say which French body, if any, confirmed the French cases.
This brief draws on eight sources. Only one of them, TechTimes (S1), deals directly with the Signal campaign, and it sits in the lowest source tier. The other seven cover separate Russian intelligence and surveillance matters and are used here only as context. Readers should treat the specific figures below as reported, not independently verified, until NÚKIB's original advisory and the earlier national advisories can be checked directly.
What Was Taken
Once a rogue device is linked, it receives a live mirror of the victim's Signal traffic. That means incoming and outgoing messages, group conversations and contact information, all in real time, for as long as the link stays active. Message encryption still works, but it protects the conversation for whoever holds a linked device, and that now includes the attacker.
Reported scale and impact:
- Global: The FBI reported in March 2026 that unauthorized access reached "thousands" of Signal accounts worldwide (as cited by TechTimes). No exact figure has been published.
- Germany: About 300 accounts in the political sphere, according to Der Spiegel citing government sources (via TechTimes).
- Netherlands: Dutch government employees were confirmed victims. The General Intelligence and Security Service (AIVD) said attackers had likely gained access to sensitive information.
- Czech Republic: NÚKIB confirms that incidents occurred but, according to the available reporting, gives no victim count.
No source gives a combined total across all affected countries. The accounts named so far point to political, governmental and policy-adjacent users rather than mass consumer targeting.
Why It Matters
The attack goes around the encryption, not through it. Many government and political users treat Signal as a safe channel for sensitive conversations that don't merit classified systems. This campaign shows that the weak point is account and device management, not the cryptography. A compromised account gives an adversary standing, real-time access to a target's conversations and their whole contact network, which is worth more for intelligence than a one-off data theft.
It fits a wider pattern of coordination between Russian services. The campaign is attributed to both the GRU and the FSB. Separately, Forensix Intelligence, summarizing SentinelLabs research it says was published with the UK NCSC and US CISA, reports that the FSB-linked Gamaredon group is handing compromised access to the GRU-linked Turla. Forensix describes this as a break from the agencies' historical rivalry. That claim comes from a single lower-tier source and isn't confirmed here. Still, a joint GRU/FSB Signal operation is consistent with it, and defenders should not assume that one Russian service's targeting stays separate from another's.
Data about the people who work against Russia is under pressure from several directions. In a separate incident, Reuters and Nextgov/FCW report that ShinyHunters claims to have stolen two to three terabytes of FBI employee data. The sample shared with journalists contained about 5,000 entries and identified analysts working on Russia, China and electronic surveillance. The FBI says it is investigating and that the cause is still undetermined. There's no evidence linking that breach to the Signal campaign. Former FBI counterintelligence operative Eric O'Neill called the alleged data "a foreign intelligence service goldmine." Personnel data of that kind is exactly what makes targeted messaging-app phishing easier.
Russia's domestic surveillance apparatus is well resourced and still active. Meduza and iStories carry the account of Ivan Kirsanov, a former developer at the Citadel holding, which builds the FSB's SORM surveillance system. Rucriminal.info, Vlast and Kartoteka report on a Moscow court case suggesting that some Russian "data lookup" services operate under the control of the security services. These reports don't concern the Signal campaign, but they show the depth of the FSB's data-collection ecosystem.
The Attack Technique
Signal lets users link secondary devices, such as desktop apps and tablets, to a primary phone account by scanning a QR code. The national advisories describe attackers abusing this flow:
- Lure delivery: Targets get phishing messages containing a QR code or link presented as something harmless, such as a group invite, a security prompt or a meeting resource.
- Silent linking: When the victim scans the code with the Signal app, it doesn't join a group or verify anything. It authorizes an attacker-controlled device as a linked device on the victim's account.
- Persistent mirroring: The attacker's device then receives the victim's message stream in real time. The victim's primary phone keeps working normally, so there is no obvious sign of compromise unless the user checks their linked-devices list.
TechTimes sums up the reporting: "The weapon is not mathematics. It is the moment a target scans a QR code without looking closely enough." No exploit of Signal's software or protocol has been reported. The technique is pure social engineering against a legitimate feature, so patching alone won't stop it.
What Organizations Should Do
- Audit linked devices now. Tell staff, especially executives, officials, policy staff and anyone in political or diplomatic roles, to open Signal > Settings > Linked Devices, remove any device they don't recognize, and repeat the check regularly.
- Treat Signal QR codes as credentials. Train users that scanning a Signal QR code can hand over full account access. Legitimate group invites and contact shares should never require scanning a code that came in an unsolicited message, email or document.
- Turn on Registration Lock and a strong PIN. This makes account re-registration attacks harder and adds friction for adversaries. It does not stop device-linking abuse on its own, so pair it with regular linked-device checks.
- Set a clear policy for Signal use. Decide which kinds of information may be discussed on consumer messaging apps. Material sensitive enough to interest the GRU or FSB likely belongs on accredited government systems.
- Build a fast reporting path. Give staff an easy way to report suspicious QR codes or unknown linked devices, and send those reports to your national CERT. NÚKIB, AIVD and their counterparts are actively collecting indicators.
- Assume broader targeting. NÚKIB says the campaign's footprint is almost certainly wider than the five documented countries. Organizations elsewhere, particularly in other NATO and EU states, should act as if they are already being targeted.
Sources: Russia Compromised Signal Accounts in Five NATO Nations; Czech Repu... | Stolen FBI data reveals employees’ roles in intelligence and survei... | He helped build the surveillance system the FSB uses to spy on Russ... | How the "Data Lookup" Market Was Shaken Up - Russian Criminal | Russian Espionage Alliance: FSB's Gamaredon and GRU-Linked Turla Co... | Exclusive-Hacked FBI data has sensitive information about employees... | The trial concerning Igor Morozkin is underway: the Userbox founder... | A leak under state guarantee: why the creators of the ’Himera’ and...