Attackers Target Signal Secure Backups via Phishing Campaign
Published
Key Takeaways
- Phishing Campaign: Threat actors are targeting Signal users to illicitly obtain recovery keys required to decrypt cloud-based backups.
- Adversarial Impersonation: Attackers are masquerading as Signal Support, alleging synchronization failures to pressure users into revealing credentials.
- Target Demographics: The campaign has impacted anti-Chinese Communist Party activists as well as other unaffiliated individuals.
A sophisticated phishing operation is currently targeting Signal users, leveraging social engineering to extract recovery keys associated with encrypted backups. By compromising these credentials, adversaries seek unauthorized access to historically archived communications.
Deceptive Social Engineering Tactics
On May 27, 2026, Washington Post analyst Josh Rogin posted evidence of the campaign via a screenshot on X. The image shows a fake message impersonating Signal Support that notifies recipients of an alleged imminent loss of backed-up data due to a synchronization error.
Rogin indicated that numerous anti-Chinese Communist Party activists were targeted. However, Mohammed Al-Maskati, director at Access Now’s Digital Security Helpline, confirmed to TechCrunch that multiple unaffiliated individuals reported receiving identical solicitations.
This phishing campaign specifically exploits Signal Secure Backups, an opt-in cloud storage feature accessible via a unique recovery key. The objective is to deceive users into disclosing this key, thereby facilitating the decryption of private message histories.
Targeting Signal Secure Backups
Signal’s security protocol dictates that the organization never initiates unsolicited contact or requests a registration code, PIN, or recovery key. Furthermore, the organization issued a formal advisory regarding this specific attack vector last month.
Multiple international intelligence organizations, including the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the UK’s cybersecurity agency, and Dutch intelligence, along with Signal, have issued official warnings about these specific hijacking techniques.
In other recent news, a GTIG report said Chinese-language phishing services adopt AI and real-time MFA bypass.
In mid-May 2026, Russian hackers were seen targeting 13,500 Signal accounts in a hijacking campaign. In March, Russian cybercriminals targeted Signal and WhatsApp accounts of high-value individuals in a large-scale phishing operation.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular