Russian Intelligence Hackers Target Signal Backup Recovery Keys in Account Takeover Attacks

Gbhackers •Mayura Kathir • July 29, 2026

Russian intelligence-linked hackers have shifted tactics to target Signal users’ backup recovery keys, enabling full account takeover and access to historical message archives without breaking Signal’s end-to-end encryption. The FBI and CISA are warning that this evolving phishing campaign focuses on high-value targets worldwide and abuses user trust in “support” messaging inside the app. These […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian Hackers Phish Signal Backup Keys for Account Takeovers Russian intelligence-linked hackers are conducting a phishing campaign targeting Signal users to obtain backup recovery keys. This method allows them to hijack accounts and access historical messages without breaching Signal's end-to-end encryption. High-value targets include officials, military personnel, journalists, and Ukrainian leaders. The FBI and CISA have issued warnings about this evolving threat, which exploits user trust in support messaging within the app. The campaign is notable for its focus on sensitive conversations and its global scope. As of now, there are no known CVEs or specific tools mentioned in the articles. The attack relies on social engineering rather than technical vulnerabilities. Users are advised to be cautious of unsolicited requests for recovery keys. 2 sources 60

Extracted Entities

Russian Intelligence Hackers Target Signal Backup Recovery Keys in Account Takeover Attacks

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)