FBI: Russian hackers now target Signal backup recovery keys

Russian Intelligence Services are conducting a phishing campaign targeting Signal users to steal Backup Recovery Keys, which would allow attackers to decrypt historical messages. This targets high-value individuals and represents a shift from account hijacking to direct message access. If successful, attackers gain persistent access to sensitive communications without breaking Signal's encryption.

HIGHAdvisoryJun 28, 2026

Action required

Hunt for phishing emails targeting your org's users with Signal-related lures. Review email logs for Signal backup/recovery key themes. Instruct users to enable registration lock in Signal settings and never share recovery keys via email or messaging. Report suspected phishing attempts to FBI/CISA.

Affected products

SignalFBICISA

Linked articles

FBI: Russian hackers now target Signal backup recovery keys

Source links

https://www.bleepingcomputer.com/news/security/fbi-russian-hackers-now-target-signal-backup-recovery-keys/