Back Feeds.4Sysops

Russian intelligence hackers use social engineering to steal Signal backup keys

Feeds.4Sysops •IT News • June 27, 2026

Russian intelligence services are conducting a sophisticated phishing campaign to steal Signal Backup Recovery Keys from high-value targets. The FBI and CISA report that attackers impersonate official support accounts to trick users into enabling cloud backups and sharing their 30-digit recovery codes. This social engineering tactic bypasses end-to-end encryption by allowing hackers to restore a victim's entire message history onto an attacker-controlled device. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FBI Warns of Russian Hackers Targeting Signal Backup Recovery Keys The FBI and CISA have issued a warning regarding a phishing campaign by Russian intelligence services targeting Signal users to steal Backup Recovery Keys. This escalation allows attackers to access victims' historical messages and take over accounts. The campaign, tracked as UNC5792 and UNC4221, primarily targets high-value individuals, including government officials and journalists. Attackers impersonate Signal support to trick users into enabling backups and sharing their 30-digit recovery codes. The phishing messages falsely claim mandatory two-factor authentication and urgent data recovery needs. Victims who share their recovery keys risk permanent loss of their data, as the key remains valid even if they create a new account. The advisory emphasizes that the attackers exploit social engineering rather than breaking Signal's encryption. The FBI is offering a reward for information on the threat actors involved. 14 sources 77

Extracted Entities

Russian intelligence hackers use social engineering to steal Signal backup keys

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)