308
Hackers steal Signal, WhatsApp user data with fake Android chat app
(www.bleepingcomputer.com)
This is a most excellent place for technology news and articles.
The malware is running on the user's phone. There it has access to all of the data, including message contents. Doesn't matter how secure the server and message encryption are.
Signal's servers were not comprimised. And like you said that would only give them a minimal dataset.