Czech Cyber Agency Says Russia-Tied Actors Hit Signal Users in Czechia; Intel Chief Warns of Escalation

Czechia's National Cyber and Information Security Agency (NÚKIB) issued a formal threat analysis on Tuesday, Oct. 13, saying actors tied to the Russian Federation are running targeted phishing campaigns against Signal users across Europe. The agency confirmed that related incidents have now occurred inside the Czech Republic.

NÚKIB said the true geographic footprint is "almost certainly larger" than the five countries where the technique has been officially documented: Ukraine, Germany, France, the Netherlands and Czechia.

The attack goes around the encryption

The agencies involved say Signal's encryption has not been broken. The Signal Protocol generates decryption keys on users' devices, not on Signal's servers.

The campaign targets a convenience feature instead. Signal lets users link one account to several devices. To add a laptop, the phone displays a QR code, and any device that scans it gets linked to the account. According to the advisories, attackers trick targets into scanning a QR code they control, which lets them quietly mirror the victim's account.

No cracked math is required, only one careless scan.

What other governments have said

The Czech warning follows similar alerts from Dutch, German, American and Ukrainian authorities over roughly the past eight months.

The FBI reported in March 2026 that unauthorized access had reached thousands of Signal accounts worldwide. Der Spiegel, citing governmental sources, reported that about 300 accounts in the German political sphere were compromised.

The Netherlands' General Intelligence and Security Service (AIVD) said Dutch government employees were among confirmed victims and that attackers had likely obtained access to sensitive information.

Intelligence chief warns, prime minister objects

On the same day, Czech counterintelligence chief Michal Koudelka spoke at an international security conference in the Czech Parliament. He said Russia could intensify hybrid attacks on NATO countries supporting Ukraine in the coming months.

He listed possible scenarios: sabotage of facilities linked to aid for Ukraine, drone or missile strikes on depots holding arms meant for Ukraine, and, in an extreme case, a limited military operation against a NATO member.

"This threat is not imminent, but it cannot be ruled out in the coming months, for example, following the announcement of some form of mobilization," Koudelka said.

He added that most Russian forces are tied down in Ukraine and that Czech counterintelligence has no specific information pointing to an immediate threat to Czechia. He called Russia the greatest external threat to Czech security, one that will persist for a long time, and urged preparedness without panic.

Babiš was not pleased. After a government meeting, he advised Koudelka to remember the motto of the Security Information Service (BIS): "Audi, vide, tace," Latin for "Listen, watch and remain silent."

Babiš said intelligence information is primarily meant for the government's use. He said Czechia cooperates with its allies and receives the intelligence it needs from them.

The prime minister's objection is about where intelligence assessments get aired, not about whether the underlying threat exists. Koudelka's own caveat, no specific indication of an imminent attack, is on the record.

The wider NATO picture

Czech President Petr Pavel took a harder line in a Fox News Digital interview published Sept. 24. He said Moscow is testing the alliance's defenses and that failing to respond decisively could invite further provocations. In the interview, Pavel argued that allies need to shoot down Russian aircraft that test NATO boundaries.

On Oct. 1, Vladimir Putin threatened to use nuclear weapons in the event of a military conflict with NATO, speaking at the Valdai Discussion Club. The same day, the U.S. Defense Department announced it would deploy about 40 Marines to the Baltic Sea region to join Finnish forces in NATO's Baltic Sentry mission, which protects critical undersea infrastructure.

Bloomberg reported on Oct. 5 that NATO Supreme Allied Commander Europe Alexus Grynkewich would present a strategy called Theory of Victory in Warsaw. The plan envisions rapidly repelling a Russian attack on NATO's eastern flank using new technologies.

None of the sources link the Signal campaign to the military warnings, and no source has tied the two together. They are separate developments from the same week, both coming from Prague.

What remains open is how far Koudelka's mobilization scenario, and Pavel's call for shooting down aircraft, will shape policy in a government whose prime minister has just told its own counterintelligence chief to stay quiet.