Warning: Federal Ministry of Defence Phishing Alert

A phishing attempt has been identified targeting individuals using the guise of the German Federal Ministry of Defence. The communication, discovered on April 15, 2026, uses a headline regarding a press conference featuring Boris Pistorius and the Ukraine Defence Contact Group to lure recipients into clicking a malicious link.

The message is written in German and addresses the recipient as Sehr geehrte Damen und Herren, stating that the Federal Ministry of Defence is providing information via an attached link. This technique is a classic example of social engineering, where attackers leverage official government branding and timely political events—such as the Ukraine Defence Contact Group—to create a sense of legitimacy and urgency.

Patterns in Government-Themed Phishing

This specific attempt aligns with a broader trend of state-linked or state-sponsored threat actors targeting government entities and high-profile individuals. Similar campaigns have been observed globally, focusing on the spoofing of official press releases and the use of compromised domains to deliver payloads.

View this post on Instagram about Defence, Signal

For example, a campaign linked to APT36 recently spoofed the Indian Ministry of Defence. That operation utilized a fake press release portal and a spoofed .in domain to deliver cross-platform malware targeting both Windows and Linux systems via HTA payloads and a technique known as ClickFix.

The goal of these operations is often to maximize effectiveness by mirroring the structure and layout of legitimate government portals, making the deception harder for the average user to detect during the initial interaction.

The Shift Toward Social Engineering

Modern phishing campaigns are increasingly moving away from relying solely on technical vulnerabilities and are instead focusing on the human element. This is evident in recent warnings issued by German cybersecurity authorities regarding the Signal messaging app.

On February 7, 2026, Germany’s Federal Office for Information Security (BSI) and the Federal Office for the Protection of the Constitution (BfV) warned of a state-sponsored campaign targeting politicians, military personnel, diplomats, and investigative journalists.

Unlike traditional malware delivery, the Signal campaign weaponized legitimate platform features. Attackers masqueraded as Signal Support or a Signal Security ChatBot, tricking users into providing PINs or verification codes received via SMS. Once the attackers obtained these codes, they could register the account on their own devices to capture incoming messages and send communications while posing as the victim.

Technical Risks and Impact

While the specific payload of the April 15 link is not detailed, government-themed phishing generally follows two primary paths: credential theft or malware installation.

• Credential Theft: Redirecting users to fake login pages designed to steal personal and sensitive information.
• Malware Delivery: Using embedded links or documents to drop payloads that can compromise an entire network.

In the case of the Signal phishing attacks, the lack of a technical exploit in the app itself meant that the security of the communication depended entirely on the user’s refusal to share verification codes. However, when malware is involved, such as in the APT36-linked campaigns, the impact extends to the operating system, potentially allowing for long-term espionage and data exfiltration.

The use of high-ranking targets—such as those involved in the Ukraine Defence Contact Group—suggests an intent to gather intelligence on sensitive military and diplomatic coordination.