Indeed, sending a little invite, saying "Install signal ..."

Sadly that's exactly what every phishing attack wants you to do.