CDU email account hijacked: 6,500 phishing emails sent – Merz also affected

TVS News AI, editorially supervised, presents CDU email account hijacked: 6,500 phishing emails sent – Merz also affected.

You open your inbox, a message with an official sender is sitting there – CDU logo, plausible signature, a short text. You click the link. This is precisely the trap that numerous recipients were apparently meant to be lured into.

As the magazine t3n reports, unknown actors hijacked a CDU email account and from there circulated around 6,500 phishing messages. Among the recipients was also Chancellor Friedrich Merz. According to the report, the emails looked "genuine" and were specifically targeted at politicians – the sender, layout, and tone were apparently designed to build trust.

That makes clear what the wave was – a targeted phishing attempt from a real CDU mailbox, not from just any domain. What the operation was meant to achieve in terms of content, t3n hints in its preview, remains not yet conclusively answered.

What has emerged from the report so far

Confirmed are three points: An internal CDU mailbox was compromised. A wave of 6,500 messages went out from it. At least one of them reached Friedrich Merz's inbox. The emails apparently carried enough of an official veneer that recipients were meant to be lured into the "trap" – typical phishing behavior, only this time from a particularly trusted source.

Open in the excerpt remains: What exactly was sent – classic data phishing via a link, malware in an attachment, a fake login page – and how the account was hijacked in the first place. An official statement from the CDU, the Federal Press Office, or the BSI is also not documented in the available report. t3n signals with its closing question "What they wanted to achieve with it," that the investigation is still ongoing.

Why a hijacked mailbox is more dangerous than normal spam

Emails from a known domain automatically lower your guard. Spam filters are less strict with trusted senders, and the first reflex of the reader drifts toward click rather than check. Attackers exploit precisely this effect when they take over an official mailbox – and they simultaneously gain more leeway.

Once you control the account, you can send follow-up emails from the same mailbox, target additional contacts, or evaluate sent correspondence. Which of these stages actually came into play in the CDU wave is not publicly documented – t3n picks up precisely this point with the question of what the attackers wanted to achieve with the operation.

What this means for you

You don't have to work in political Berlin to walk into a comparable trap. Public agencies, associations, clubs, or employers can also become targets of such attacks – and you then receive an email that looks as if it came from a trusted source. What helps quickly in such cases: Check the destination URL before clicking (hovering over the link with the mouse is enough), for requests for quick entries it's better to call the sender once rather than respond to the email – and forward suspicious messages from real mailboxes to the relevant reporting center.