The European Union (EU) confirmed that state-sponsored hackers have been spear-phishing government officials on popular messaging apps rather than email.
Nation-state advanced persistent threats (APTs) commonly socially engineer their nation-state targets over email, impersonating quotidian business to trick targets into opening malicious websites or attachments. Yet email is where most employees expect malicious messages to come from. Messaging apps don't carry the same reputation, and encrypted ones — like WhatsApp and Signal in particular — add an extra sheen of trusted security.
Recently, state APTs have been shifting their phishing campaigns, looking to leverage the trust high-level government employees have in their messaging apps — the blitheness and urgency with which they open and respond to instant messages. The problem is particularly bad in Europe. According to an internal document recently obtained by Politico, EU bloc governments have faced eight "significant incidents" of spear-phishing over WhatsApp and Signal in 2026.
EU Officials Phished Over WhatsApp & Signal
On Feb. 6, two German government authorities published a joint security notice indicating that a "likely state-controlled" threat actor was using messaging services like Signal to target high-ranking individuals in the military, diplomacy, and politics, both in Germany and Europe more broadly.
The incidents involved no software vulnerabilities or malware, only social engineering. In some cases, attackers were impersonating Signal's official support team or support chatbot, reaching out to targets with urgent security alerts that suggested they were at risk of losing their data and goading them into providing their account PINs. In other cases, attackers reached out to targets with whatever pretext might convince them to scan QR codes. Targets didn't realize that those QR codes linked attackers' devices to their accounts.
"There is definitely a trend of threat actors moving communications outside of email with their phishing attacks," says Volexity president Steven Adair. "Sometimes the initial outreach is via Signal, WhatsApp, Telegram, LINE, etc. Otherwise, we often see email as the starting point with an attempt to move the follow-on communication to these other platforms." The trend is becoming common among Russian, Chinese, and Iranian threat actors, he says, because, "Moving to these other channels often puts actual detailed communication and phishing lures outside of the visibility of security monitoring. Further, many of these alternative communication channels allow the messages to be deleted — something you cannot really do with email."