Signal Launched Verified In-App Chat to Combat Phishing

Signal's verified "Official Chat" has reached iOS, giving every user a single authenticated channel from the company. It arrives after state-linked phishing campaigns impersonating Signal support compromised accounts belonging to politicians, officials, and journalists across Europe and the US.

Signal users on iPhone are now receiving a welcome message from a chat simply named "Signal," carrying a blue verification check and an "Official Chat" badge. The channel, which Signal uses to announce new features and release notes, previously existed on Android and Desktop and reached iOS with version 8.17 in June, according to release trackers.

The welcome message does more than introduce the feature. "This is the only official chat from Signal," it reads, telling users to never respond to other chats pretending to be the company. The chat is muted by default and can be blocked outright.

That warning is doing real work, because impersonating Signal has been one of the most effective espionage tricks of the past year.

In February 2026, Germany's domestic intelligence agency (BfV) and its federal cybersecurity office (BSI) warned that a likely state-controlled actor was phishing senior political figures, military officials, diplomats, and journalists through Signal itself. Attackers posed as "Signal Support" or a "Signal Security ChatBot," warned targets of suspicious account activity, and walked them into scanning a QR code or handing over a verification code. Doing so linked the victim's account to an attacker-controlled device, exposing contacts, message history, and ongoing conversations.

The fallout in Germany has been significant. Federal prosecutors opened an espionage investigation in mid-February, and Der Spiegel reported that around 300 accounts belonging to people in the political sphere were compromised. A government spokesperson said victims included high-ranking politicians, among them two ministers, and that Berlin suspects Russia, though no official attribution has been made. Moscow denies involvement.

The campaign was never just a German problem. In March, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint public service announcement attributing a global phishing campaign against commercial messaging apps to actors associated with Russian Intelligence Services. The agencies said the activity targeted current and former US government officials, military personnel, political figures, and journalists, and had produced unauthorized access to thousands of individual accounts. French and Dutch authorities issued similar warnings.

One detail matters for how this story gets told: none of these operations broke Signal's encryption or the app itself. They exploited trust. If an attacker can convincingly play the role of Signal support, the strongest protocol in the world does not help.

Signal has been closing that gap all year. Alongside the official chat rollout, recent updates added warnings that profile names are not verified identities, extra confirmation steps for message requests, and repeated in-app reminders that Signal will never ask for a registration code, PIN, or recovery key.