RUSSIAN HACKERS TARGET SIGNAL BACKUP KEYS

Russian-linked threat actors have escalated their campaign against Signal users by focusing on stealing Signal Backup Recovery Keys through phishing attacks. These keys grant access to encrypted message archives, exposing sensitive communications even when the app itself remains secure. The FBI and Cybersecurity and Infrastructure Agency (CISA) issued the warning as the campaign evolved from initial reconnaissance. Phishing emails are designed to trick users into revealing their recovery credentials. Signal's backup feature encrypts messages locally before storing them, but possession of the recovery key allows decryption. Users are advised to guard recovery keys as closely as passwords and enable additional authentication protections. The campaign reflects a shift in tactics by state-sponsored actors targeting encrypted messaging platforms. Instead of breaking encryption, adversaries now pursue user credentials to bypass security layers directly. Organizations and individuals using Signal for sensitive communications should review their backup security settings immediately.