Security Alert: Sophisticated Phishing Campaign Targets Signal Secure Backups

A new wave of targeted phishing attacks is currently exploiting Signal’s in-app messaging ecosystem to compromise user privacy. Unlike traditional phishing attempts that aim for immediate account takeover, this campaign utilizes social engineering to exfiltrate Secure Backup recovery keys, potentially granting attackers access to years of encrypted communication history.

The attackers deploy a highly deceptive tactic, masquerading as “Signal Support” through direct messages. While the app correctly flags these accounts with a “Name not verified” warning, the sophisticated nature of the social engineering—leveraging perceived technical urgency—is designed to bypass the user’s natural skepticism.

The Anatomy of the Attack

The fraudulent messages utilize high-pressure psychological triggers, often headlined with subject lines like “Action Required: Data Recovery Needed.” The attackers claim that a phantom “sync issue” threatens the user with imminent and permanent data loss. To resolve this supposed crisis, users are instructed to follow a specific, malicious protocol:

1. Navigate to Signal Settings.
2. Access the Backups menu.
3. Locate and copy the unique recovery key.
4. Paste the key directly into the chat window with the “Support” account.

The attackers falsely claim this process is required to “link” the existing backup to the account. In reality, providing this key is the equivalent of handing over the master cryptographic key to the user’s entire digital archive.

Technical Implications: Archive Theft vs. Account Hijacking

It is critical to distinguish this campaign from previous Signal exploits. While earlier attacks focused on intercepting SMS registration codes to hijack active sessions, this campaign focuses on long-term archive theft. By targeting the Secure Backup feature, attackers aim to decrypt the stored message database, which contains historical media, documents, and sensitive metadata.

Because Signal utilizes end-to-end encryption where the recovery key remains exclusively on the user’s device, the theft of this key is the only viable path for an attacker to decrypt a cloud-stored backup. Once obtained, the attacker can restore the user’s entire historical footprint in plaintext on a separate device.

Threat Intelligence Note: Researchers, including Josh Rogin, have noted that this campaign appears to be highly targeted. Reports suggest that journalists, dissidents, and anti-CCP activists are being disproportionately hit, pointing toward state-sponsored or politically motivated threat actors.

Defensive Strategies and Mitigation

Signal has a strict operational policy: Signal will never initiate contact with users via in-app messaging, nor will they ever request recovery keys, PINs, or registration codes.

To harden your device against these and future social engineering attempts, security experts recommend the following technical hygiene:

• Enable Registration Lock: This adds an extra layer of security, requiring a PIN to re-register your number on a new device.
• Utilize Disappearing Messages: By reducing the temporal footprint of your data, you minimize the “blast radius” of a potential backup compromise.
• Verify via Official Channels: If you receive an urgent alert, ignore the in-app prompt and consult Signal’s official documentation or support site directly.
• Report and Block: Immediately report any unverified account claiming to be official support to prevent further spread.

For high-risk individuals—including human rights defenders and investigative journalists—treating all unsolicited technical “urgency” with extreme skepticism is the most effective defense against these coordinated surveillance operations.