Back Securityaffairs.Co

New FBI Alert: Russian Intelligence Uses Signal Recovery Keys to Access Messages

Securityaffairs.Co •Pierluigi Paganini • June 27, 2026

FBI warns Russian spies now target Signal Backup Recovery Keys, enabling access to message history and long-term account takeover. The FBI and CISA updated their March 2026 warning Russian intelligence phishing campaigns, and the new advisory adds a detail that wasn’t in the original: the operators have shifted their primary objective from stealing verification […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FBI Warns of Russian Hackers Targeting Signal Backup Recovery Keys The FBI and CISA have issued a warning regarding a phishing campaign by Russian intelligence services targeting Signal users to steal Backup Recovery Keys. This escalation allows attackers to access victims' historical messages and take over accounts. The campaign, tracked as UNC5792 and UNC4221, primarily targets high-value individuals, including government officials and journalists. Attackers impersonate Signal support to trick users into enabling backups and sharing their 30-digit recovery codes. The phishing messages falsely claim mandatory two-factor authentication and urgent data recovery needs. Victims who share their recovery keys risk permanent loss of their data, as the key remains valid even if they create a new account. The advisory emphasizes that the attackers exploit social engineering rather than breaking Signal's encryption. The FBI is offering a reward for information on the threat actors involved. 14 sources 77

Extracted Entities

New FBI Alert: Russian Intelligence Uses Signal Recovery Keys to Access Messages

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)