Signal Backup Keys: The New Target in Phishing Scams
Russian intelligence groups are phishing for Signal backup keys to access your message history. Here's what you need to know to protect your private conversations.
Source
GetCyberRight Intelligence
Original headline: Signal Backup Key Phishing Myth vs Reality
Plain-English summary by GetCyberRight. Read the full report at the source above.
What's Happening
Russian intelligence-linked phishing campaigns are now targeting Signal users with fake messages designed to steal backup recovery keys. These keys unlock your entire message history, turning Signal's strong encryption into a false sense of security if compromised. This is a sophisticated attack on one of the most trusted secure messaging apps.
The Details
Signal is known for its end-to-end encryption, which means messages are scrambled between you and the person you're messaging. No one in between can read them, not even Signal itself. This protection works perfectly for live conversations.
The complication comes with message backups. When you create a backup of your Signal messages (to save them or transfer to a new phone), Signal generates a special recovery key. This key is like a master password that can decrypt your entire message history. If someone tricks you into sharing this key, they can access every backed-up message you've ever sent.
The phishing scams work like this: You receive an official-looking email or message claiming to be from Signal. It says there's a security problem, your account needs verification, or you need to re-enter your backup key. The message includes a link to a fake website that looks exactly like Signal's real site. When you enter your recovery key, attackers capture it immediately.
Who Is Affected
Anyone using Signal's backup feature is potentially at risk. This includes journalists, activists, business professionals, and families who rely on Signal for private conversations. If you've ever created a backup of your Signal messages or written down a recovery key, you're a possible target.
Parents coordinating sensitive family matters, couples discussing personal finances, or anyone sharing health information through Signal should pay extra attention. The attackers aren't just after high-profile targets anymore. They cast wide nets hoping to catch anyone with valuable information in their message history.
What You Should Do Right Now
Never share your Signal backup key with anyone. Signal will never ask for it via email, text, or any message. Store it offline in a secure location like a password manager or written in a locked safe.
Stay one step ahead of scammers
Weekly cybersecurity briefings for families. No spam, just the threats that matter and what to do about them.
Check the sender carefully. Signal's official communications come only through the app itself or from verified email addresses ending in @signal.org. Hover over links before clicking to verify the actual URL.
Enable registration lock in Signal. Open Signal, go to Settings > Account > Registration Lock. This adds a PIN requirement that makes it harder for attackers to hijack your account even with other information.
Consider whether you need message backups. If you don't regularly switch phones or need to preserve message history, disable backup features. This eliminates the vulnerability entirely.
Report suspicious messages. Forward phishing attempts to your email provider's abuse team and delete them immediately. Don't click any links, even to "unsubscribe."
The Bigger Picture
This campaign shows how attackers evolve alongside our security tools. As more people adopt encrypted messaging for privacy, criminals and state actors adapt by targeting the backup and recovery systems instead of the encryption itself. The weakest link is usually human trust, not technology. Staying informed about new phishing tactics protects not just your messages, but your family's privacy and safety.
How GetCyberRight Can Help
Our GCR Scam Guard tool helps families identify phishing attempts before they cause damage. It analyzes suspicious messages and websites targeting messaging apps like Signal, WhatsApp, and Telegram. Scam Guard checks for telltale signs of credential theft attempts and alerts you to recovery key phishing specifically. Think of it as a second pair of expert eyes reviewing anything that seems off, helping your whole family stay one step ahead of these evolving threats.
Curated from trusted cybersecurity sources by GetCyberRight
Source: GetCyberRight IntelligenceStay ahead of cyber threats
Get our free weekly digest. Real threats, plain language, what to do about them. No spam, ever.
More articles
Russian Hackers Are Targeting Signal Backup Keys to Read Your Messages
Intelligence agencies warn that Signal users are being phished for backup recovery keys, giving attackers access to encrypted message history.
4 min readRussian Hackers Are Phishing for Your Signal Backup Keys, FBI Warns
Federal agencies warn that Russian intelligence is targeting Signal users with phishing attacks designed to steal backup recovery keys and hijack encrypted accounts.
3 min readPrime Day Scams: The Fake Deal Sites Targeting Your Family This Week
Scammers create thousands of fake shopping sites during Prime Day to steal your payment information. Here's how to spot them and shop safely.
3 min readPrime Day Phishing Myth Busted: Scammers Have Upped Their Game
Think you can spot fake Amazon emails by spelling errors? Today's scammers are more sophisticated, and Prime Day shoppers are prime targets.
3 min read