Russian Hackers Now Stealing Signal Messenger Backup Keys in Latest Phishing Push

A New Threat Emerges Against Signal Users

Federal law enforcement agencies have sounded an alarm about a worrying development in cyberattacks. Russian intelligence operatives are running a new phishing campaign that goes beyond simply tricking people into revealing their passwords. These attackers are now convincing targets to hand over their Signal Backup Recovery Key—a special security code that acts like a master key to your encrypted conversations.

This represents an evolution of warnings that first surfaced in March. What began as basic phishing attempts against Signal users has transformed into something more sophisticated and dangerous. The attackers have added an extra step designed to give them complete access to someone's message history.

Understanding the Vulnerability

To understand why this matters, think of Signal like a locked diary. The Backup Recovery Key is essentially the combination to that lock. Once someone obtains this key, they can restore an entire account backup on a different device—which means they can read every message, see every conversation, and access all the sensitive information that was supposed to stay private.

The phishing process typically works like this: criminals send messages that appear to come from legitimate sources. They convince the target that something is wrong with their account or that they need to verify their identity. In the process, they manipulate the person into voluntarily sharing their recovery key. Unlike a password that can be changed, once this key is compromised, it provides a backdoor that's difficult to close.

Why This Matters to You

Signal is trusted by journalists, activists, business executives, and anyone who values private communication. If attackers can gain access to these accounts, they can spy on sensitive discussions, uncover confidential information, or use gathered intelligence for blackmail. For organizations, this could mean stolen trade secrets. For individuals, it could expose personal relationships or vulnerable information.

The fact that Russian intelligence agencies are behind these attacks elevates the concern. This isn't random cybercriminals looking for quick money—this is a nation-state with resources and motivation to target specific high-value individuals or organizations.

Protecting Yourself

• Never share your recovery key. Signal will never ask you for this code through messages or emails. Legitimate companies communicate important security matters through official channels, not through unsolicited messages.
• Verify before clicking. If you receive a message claiming to be from Signal about account issues, visit the official Signal website directly rather than clicking any provided links.
• Watch for urgency. Phishing messages often create artificial pressure—"Your account will be locked!" or "Verify immediately!" Slow down and think before responding.
• Enable additional security. Use two-factor authentication wherever available, and consider enabling registration locks on Signal if the feature is available in your region.
• Stay informed. Follow official security announcements from FBI and CISA, or your country's equivalent agencies.

What This Means Going Forward

As attackers become more sophisticated, the security burden increasingly falls on users to stay alert and informed. This latest campaign shows how threats evolve constantly—what worked last month becomes the foundation for something more dangerous this month.

If you use Signal or any encrypted messaging platform, treat your backup recovery key like you would treat the keys to your home: guard them carefully and never share them, regardless of who asks.