FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys

The cybersecurity landscape continues to evolve as Russian intelligence actors refine their tactics against encrypted communications. Federal authorities have identified an alarming escalation in phishing attacks targeting the popular messaging platform Signal, with threat actors now focusing on compromising backup recovery keys—a development that significantly elevates the risk to users maintaining sensitive communications.

According to an updated advisory from the FBI and Cybersecurity and Infrastructure Security Agency (CISA), state-sponsored hackers associated with Russian intelligence have expanded their operations beyond traditional credential harvesting. These actors now employ sophisticated social engineering techniques designed to manipulate victims into surrendering their Signal Backup Recovery Keys. This updated warning builds on previous alerts from March, indicating that the threat campaign has not only continued but has evolved to incorporate more dangerous methods. Once obtained, these keys enable attackers to restore complete account backups, granting them access to entire message histories—including private and group conversations—and potentially facilitating complete account takeovers. Particularly concerning is the persistent functionality of these compromised keys, meaning the unauthorized access continues indefinitely even after the initial compromise.

This development carries significant implications for security teams across government agencies, corporate enterprises, and organizations handling sensitive information