Hackers are abusing Signal’s in‑app messaging to trick users into giving up their backup recovery keys, allowing attackers to unlock years of supposedly private conversations in a new phishing wave.
The campaign uses messages that appear to come from “Signal Support” and warn of imminent data loss. However, they are fraudulent and designed to steal victims’ encrypted chat backups.
Victims receive a direct message from an account named “Signal Support,” marked with a “Name not verified” warning and generic safety tips inside the app.
The message claims “Action Required: Data Recovery Needed” and states that the user’s account data is at risk of permanent loss due to a sync issue, urging them to act quickly to avoid losing messages and media.
It then instructs users to open Signal’s Settings, navigate to Backups, view their recovery key, copy it to the clipboard, and paste it back into the chat.
The text falsely says this will “link your existing backup” to the account and warns that failure to comply may result in losing access to all stored data, adding pressure and urgency typical of phishing attacks.
In reality, this operation has no connection to Signal’s real support team, and there is no backup sync issue affecting targeted users.
Researchers and digital rights organizations report that multiple people have received near‑identical messages, confirming the activity is a coordinated phishing campaign rather than random scam attempts.
Hackers Target Signal Users
According to the report, the attack specifically targets Signal’s Secure Backups feature, which lets users store encrypted copies of their chats and media on Signal’s servers, protected by a unique recovery key that never leaves the user’s devices.
That key is the only way to decrypt the backup, meaning anyone who obtains it and can access the account can download and read the victim’s full message history in plaintext.
Unlike earlier Signal hijacking attacks that focused on stealing registration codes to take over live accounts, this campaign concentrates on archive theft, going after years of past conversations rather than just future messages.
Security experts warn that backups often contain old documents, photos, and sensitive discussions that users assume are safe because they remain encrypted on Signal’s infrastructure.
So far, reports indicate that journalists, dissidents, and anti‑Chinese Communist Party activists are disproportionately targeted, suggesting a politically motivated or at least surveillance‑oriented threat actor.
Human rights defenders and researchers who track threats to civil society have also flagged this pattern, noting that such groups routinely face phishing campaigns aimed at compromising secure communication tools.
Signal has repeatedly emphasized that it will never contact users first inside the app, and it will never ask for registration codes, PINs, or backup recovery keys under any circumstances.
That means any in‑app chat claiming to be “Signal Support” and requesting sensitive codes or keys should be treated as malicious and ignored. Experts recommend that users immediately block and report such accounts, and never paste a recovery key, login code, or PIN into a chat window, even if it appears to be part of the app.
To reduce risk, users are advised to enable registration lock, protect Signal with a strong PIN, and turn on device‑change alerts, so that any attempt to move an account to a new phone is clearly visible.
Using disappearing messages by default can also limit the damage if an attacker ever manages to obtain a backup, since less historical content will be stored.
Security teams supporting journalists, activists, and other high‑risk communities are urging their members to treat any urgent backup or account‑warning message with skepticism and verify it through official Signal documentation or trusted security channels before taking action.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
