Czech cyber agency warns Russia-linked hackers are hijacking Signal accounts with fake alerts and QR codes

Key takeaways

• The Czech National Cyber and Information Security Agency (NÚKIB) said on 13 October that actors linked to Russia are running targeted phishing campaigns against Signal users.
• The agency says related cyber incidents have taken place in the Czech Republic; similar methods have been seen in Ukraine, Germany, France and the Netherlands.
• Attackers are not breaking Signal's end-to-end encryption. They trick people into linking an attacker's device to their account or handing over their PIN.
• Targets so far are mainly people in government, security and politics — but the tricks work on anyone.
• Simple steps such as checking linked devices and turning on Registration Lock block much of the risk.

What NÚKIB found

In its advisory, NÚKIB describes two main methods:

1. Fake Signal notifications. If attackers know your phone number, they send a message that looks like it comes from Signal support or a security alert. The link or code inside quietly connects their device to your account.
2. Malicious QR codes. A QR code presented as an invitation to join a group actually links your account to the attacker's device.

Both tricks may also ask for your Signal PIN or recovery details under a false excuse. Once a device is linked, the attacker can read new messages and see contacts. The agency says the true geographic spread is probably wider than the countries named so far.

How this fits a wider pattern

Tech Times reports that NÚKIB is the latest of several Western agencies — including Dutch, German, US and Ukrainian authorities — to warn about the same kind of campaign over the past months, and that all have stressed the app's encryption itself has not been cracked. The outlet also cites earlier reporting that hundreds of accounts in Germany's political sphere were affected. These earlier figures come from the outlet's summary of other reports and were not part of the Czech advisory.

How to protect your Signal account

NÚKIB's recommendations, in plain steps:

The same habits help with WhatsApp and other apps that let you link a computer or second phone by scanning a QR code.

Why it matters for readers in Pakistan and India

Signal and WhatsApp are widely used by journalists, officials, lawyers and businesses in South Asia. The attack does not need any technical weakness — only one careless tap or scan — so the protective steps above are worth doing today.

What to watch

• Whether other European agencies or Signal itself publish new guidance or app changes, such as clearer alerts when a new device is linked.
• Any official attribution to specific Russian groups by Czech authorities.