Russian Hackers Have a New Way Into Your Signal Messages — and It's Disturbingly Simple

Russian Hackers Have a New Way Into Your Signal Messages — and It's Disturbingly Simple

If you use Signal and have ever received a message warning you about a security update or an account sync problem, read this carefully.

The FBI and CISA have issued an updated warning about a sophisticated phishing campaign, tied to Russian intelligence services, that has quietly evolved into something more dangerous than its earlier form. Rather than trying to crack Signal's famously strong encryption — which remains unbroken — these attackers have found a far easier path in: your backup recovery key.

How the Scam Works

It starts with a convincing message. The attackers pose as Signal's support team and tell you that following a wave of hacking attempts by actors from Iran and post-Soviet countries, Signal is rolling out "mandatory two-factor verification." It feels urgent. It looks official. And it comes with step-by-step instructions.

Those instructions walk you through enabling Signal's Secure Backup feature and, crucially, copying your recovery key to your clipboard. A short while later, a second message arrives claiming there's a sync issue putting your data at risk of permanent loss. The fix? Paste that recovery key into the chat.

The moment you do, it's over. That key is all an attacker needs to restore a full copy of your Signal backup — your messages, your media, your private and group conversations — on a device you'll never see.

Why This Is Especially Dangerous

What makes this attack so effective is how well it exploits trust. Signal has built its reputation on privacy, so a message about securing your account doesn't automatically raise alarms. The instructions the attackers provide are technically accurate — they're just leading you toward handing over the keys to your own data.

According to the FBI, the campaign is specifically targeting high-value individuals: current and former U.S. and international government officials, military personnel, political figures, journalists, and officials based in Ukraine. The operation is linked to Russia's Federal Security Service (FSB) and tracked under the names UNC5792 and UNC4221.

There's No Easy Fix If You've Already Been Compromised

Here's the part that should alarm anyone who thinks they might have been caught out: creating a new Signal account with the same phone number does not invalidate a stolen recovery key. The old key still works on backups that were already made.

The only real remedy is to go into Signal's backup settings and generate a new recovery key, which does cancel the old one going forward. But it won't undo any damage already done — if someone downloaded your backup before you changed the key, they still have everything.

What to Look Out For

The warning signs, once you know them, are clear. Legitimate companies — Signal included — never contact users inside the app itself to ask for security keys or verification codes. They don't send urgent messages warning about imminent data loss. They don't provide step-by-step instructions that end with you pasting sensitive credentials into a chat window.

If you receive any message like this, don't follow the instructions. And if you think you may have already done so, report it to the FBI's Internet Crime Complaint Center (IC3) or your local FBI field office.

Signal remains one of the most secure messaging platforms available. But no amount of encryption can protect you from being talked into handing over the keys yourself.