Nobody Broke Signal's Encryption. They Just Got People to Scan a QR Code

On October 13, 2026, the Czech Republic's National Cyber and Information Security Agency (NUKIB) published a formal threat analysis that should change how every messenger builder thinks about security. It confirmed that actors tied to the Russian Federation are running targeted phishing campaigns against Signal users across Europe, and that related incidents have now happened inside the Czech Republic itself.

That makes five Western agencies that have now publicly confirmed the same operation: the Netherlands, Germany, the United States, Ukraine, and now the Czech Republic. The FBI said in March 2026 that unauthorized access had reached thousands of Signal accounts worldwide. In Germany alone, roughly 300 accounts in the political sphere were compromised, according to Der Spiegel citing government sources. NUKIB warns the real footprint is almost certainly larger than the five countries where the technique has been officially documented.

Here is the part that matters most, and every one of those agencies agrees on it: Signal's end-to-end encryption was not broken. Nobody cracked the Signal Protocol. The attack goes around the cryptography entirely, through a feature that ships in every copy of Signal: linked devices.

How the attack actually works

When you link a laptop to your Signal account, your phone shows a QR code. Whatever scans that code gets paired to your account and receives your messages in real time. The attackers replace the legitimate QR code with a malicious one.

Google's Threat Intelligence Group documented the technique in early 2025. One variant, run by the group tracked as UNC5792, hosts fake Signal group invitation pages that look identical to the real thing. The QR code on the page does not encode a group invitation. It encodes a device-linking address pointing at attacker infrastructure. The victim thinks they are joining a group. They are actually pairing their account to someone else's machine.

Another variant, tracked as UNC4221, hid malicious QR codes inside a phishing kit that mimicked Kropyva, an artillery guidance app used by Ukrainian armed forces. The victim believed they were completing a routine operational step. Other clusters went lower tech: Turla used PowerShell scripts to pull Signal messages from compromised Windows machines, and a Belarus-linked cluster used the plain Robocopy file-copy utility to copy desktop Signal database files. Once you have the already-decrypted local database, encryption is irrelevant.

NUKIB describes a second vector that is even simpler: a message crafted to look like a legitimate Signal notification, a support alert, a security warning, a group invitation, with a link or QR code inside. Signal's real support team does not contact users through the app, and it never asks for a PIN or registration credentials in a message. But a convincing fake does not need to be perfect. It needs one tired person, once.

And here is the detail that should worry builders the most. According to Google's threat researchers, compromises established this way can go unnoticed for extended periods of time. Signal deliberately keeps no centralized server-side log of device-pairing events, because logging them would create a metadata trail about who links what, when. That is a principled privacy choice, and it is also the reason there is no reliable audit trail to catch a silent pairing. The same design decision protects users from bulk metadata collection and leaves them blind to this attack. Both things are true at the same time.

The same trick, from the other side of the law

This is not only a story about intelligence agencies. On September 30, 2026, Privacy Guides reported on documents obtained by Netzpolitik showing that German customs officials have been using the linked-device feature of messengers to read suspects' messages without breaking any encryption. They tested the approach starting at the end of 2023, and since August 2025 it has been an official, permanent strategy available to agents. The messengers affected include WhatsApp, Telegram, Threema, and Signal.

The implementations differ in how easy they make it. Telegram sends a login code to an existing device, and that code can be phished. WhatsApp is somewhat better: linking has to be started from inside the app, so an attacker cannot just send a code unprompted, but a victim can still be coached into typing in a linking code. Signal only allows linking through a QR code, and a QR code can still be sent by an attacker and scanned by a victim who has no idea what it really authorizes.

Put the two stories together and the pattern is unmistakable. The linked-device flow is now a standard tool for anyone who wants into an encrypted account, state actor or police agency alike, and it works precisely because it never touches the encryption. When the Dutch military intelligence director said publicly that even end-to-end encrypted apps are not appropriate for classified government information, this is the kind of thing he meant.

What I am taking into my own messenger

I build a small end-to-end encrypted messenger, and I recently shipped a safety-number feature for it: a fingerprint over both parties' identity keys, with a warning and a confirmation step if a contact's key changes. That feature protects against a specific threat, a silent key swap in the middle of a conversation. Writing about this campaign forced me to be honest about what it does not protect against. A linked device receives legitimate keys through a legitimate flow. Key verification passes. The safety number matches. Everything looks fine, because from the protocol's point of view, nothing went wrong. A new device joined, and the protocol did what it was asked to do.

So if you are building a messenger, here is where I think the real work is:

First, treat pairing like handing someone a copy of the account, because that is what it is. The pairing screen should say so in plain words, not in a vague "link a device" label. Users cannot defend a step they do not understand.

Second, a new pairing must be loud. A push notification, a persistent in-app banner, and an entry in the device list that stays visible until the user acknowledges it. A pairing that can happen silently is a pairing that will be abused silently.

Third, show what the QR code authorizes before the scan completes, and require a second confirmation on the phone itself: the device type, a name, and what it will be able to do. A QR code is opaque by design, and opaque approval steps are phishing bait. The phone already knows what it is about to approve. It should tell the user.

Fourth, make the device list a first-class screen, not a settings afterthought. The single highest-leverage habit in NUKIB's advisory is also the simplest: open Settings, then Linked Devices, and remove anything you do not recognize. If your app buries that list three menus deep, most users will never open it.

And one correction worth stating plainly, because I have seen it repeated wrongly: Signal's Registration Lock is worth turning on, but it is not the fix for this attack. Registration Lock blocks someone from re-registering your number on a new phone without your PIN. This attack does not re-register anything. It pairs a new device to an account that is already registered. Different flow, different defense. Conflating them leaves people feeling protected when they are not.

The uncomfortable lesson

Messenger security arguments usually end at the protocol. Is the ratchet sound, is the key exchange post-quantum, is the code audited. All of that matters, and none of it saved a single account in this campaign. The accounts fell at the boundary between the protocol and the person: a QR code that meant one thing to the user and another thing to the machine, a device list nobody checked, a pairing nobody noticed.

If you build messengers, that boundary is your product now. The cryptography is the easy part to get right and the hard part to explain. The pairing flow is the opposite: easy to build, easy to get wrong, and it is where real accounts are actually being lost in 2026.

For users, the checklist is short. Check your linked devices today, in whatever messenger you use, and remove anything unfamiliar. Never scan a QR code from an unsolicited message, no matter how official it looks. Turn on Registration Lock anyway, because it raises the cost of the neighboring attacks. And remember that the strongest encryption in the world only protects the messages. It does not protect the account.

Sources: NUKIB threat analysis (October 13, 2026); FBI public service announcement (March 20, 2026); joint AIVD/MIVD advisory (March 9, 2026); Google Threat Intelligence Group documentation of the device-linking technique (early 2025); Netzpolitik documents on German customs messenger surveillance, via Privacy Guides (September 30, 2026).