Russian Hackers Target Signal Users with Sophisticated Phishing Scam

The FBI and CISA have issued an updated warning about a phishing campaign targeting Signal users, particularly those with high intelligence value such as government officials, military personnel, and journalists. The attackers, believed to be linked to Russian Intelligence Services, have added a new tactic to their strategy: convincing victims to hand over their Signal Backup Recovery Key. This key allows the attacker to restore the account's backup, read private and group message history, and take control of the account. The key remains active even if the user creates a new account with the same phone number, making it a significant security risk. To protect themselves, users are advised to generate a new key in their settings, which will render the old key useless for future backup downloads. However, any data that has already been compromised will be lost. The phishing campaign, which also targets WhatsApp users, involves attackers posing as Signal support staff and asking victims to provide their recovery key or other sensitive information. The FBI and CISA emphasize that the attackers are not breaking Signal's encryption, but rather using social engineering tactics to compromise individual accounts. The State Department's Rewards for Justice program is offering up to $10 million for information on the attackers, and users are advised to be cautious when receiving in-app messages from supposed Signal support staff. To stay safe, users should never paste their Backup Recovery Key, verification code, or PIN into a chat, and should regularly check their linked devices and remove any unrecognized ones. If a user suspects they have handed over their Recovery Key, they should generate a new one immediately and assume any previous backups are compromised.