The FBI and CISA warn of a phishing campaign by Russian intelligence services targeting Signal users to steal Signal Backup Recovery Keys, enabling attackers to access victims' historical messages. The campaign impersonates Signal support and uses phishing messages to manipulate victims into enabling Signal Secure Backups and revealing their recovery keys. Targets include US and international government officials, military personnel, political figures, journalists, and key officials in Ukraine. The threat actors pose as support teams and falsely claim new mandatory two-factor verification measures to lure victims. Attackers then prompt victims to provide their Backup Recovery Keys, which allows them to restore Signal backups on their devices and access private conversations. The FBI warns that creating a new Signal account with the same phone number does not invalidate previous stolen keys and recommends generating a new recovery key to prevent future access by attackers, but this does not affect backups already stolen. The advisory stresses that legitimate Signal support does not request recovery keys and advises victims to report incidents to the FBI IC3 or CISA.

The FBI and CISA warn of a phishing campaign by Russian intelligence services targeting Signal users to steal Signal Backup Recovery Keys, enabling attackers to access victims' historical messages. The campaign impersonates Signal support and uses phishing messages to manipulate victims into enabling Signal Secure Backups and revealing their recovery keys. Targets include US and international government officials, military personnel, political figures, journalists, and key officials in Ukraine. The threat actors pose as support teams and falsely claim new mandatory two-factor verification measures to lure victims. Attackers then prompt victims to provide their Backup Recovery Keys, which allows them to restore Signal backups on their devices and access private conversations. The FBI warns that creating a new Signal account with the same phone number does not invalidate previous stolen keys and recommends generating a new recovery key to prevent future access by attackers, but this does not affect backups already stolen. The advisory stresses that legitimate Signal support does not request recovery keys and advises victims to report incidents to the FBI IC3 or CISA.