FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys

The FBI and CISA issued a joint cybersecurity advisory on March 18, 2024, warning that Russian intelligence actors are targeting Signal users by attempting to steal their Signal Backup Recovery Keys. This phishing campaign, an escalation from earlier efforts to compromise Signal accounts, now aims to trick users into revealing their recovery keys. Once obtained, an attacker can use the key to restore a compromised Signal account's backup, granting them access to the entire message history, including private and group chats. The advisory emphasizes that the recovery key remains functional even after being compromised, allowing persistent access for the threat actor. The FBI and CISA urge users to be vigilant against these phishing attempts and to protect their Signal Backup Recovery Keys.