Russian Hackers Phish Signal Backup Keys for Account Takeovers

Russian intelligence-linked hackers are conducting a phishing campaign targeting Signal users to obtain backup recovery keys. This method allows them to hijack accounts and access historical messages without breaching Signal's end-to-end encryption. High-value targets include officials, military personnel, journalists, and Ukrainian leaders. The FBI and CISA have issued warnings about this evolving threat, which exploits user trust in support messaging within the app. The campaign is notable for its focus on sensitive conversations and its global scope. As of now, there are no known CVEs or specific tools mentioned in the articles. The attack relies on social engineering rather than technical vulnerabilities. Users are advised to be cautious of unsolicited requests for recovery keys.

Key Points: • Russian intelligence hackers are phishing for Signal backup recovery keys. • The campaign targets high-value individuals, including officials and journalists. • FBI and CISA have issued warnings about the evolving phishing tactics.