FBI: Russian Hackers Use Signal Recovery Key Phishing to Read Messages

FBI Warns: Russian Hackers Now Phishing for Signal Backup Recovery Keys

The FBI and CISA have updated their advisory on Russian intelligence hackers targeting Signal users. The new twist: attackers are now phishing for backup recovery keys, which give persistent access to message history even after the victim switches phones. The advisory, designated PSA I-062626-PSA, ties the activity to two threat groups: UNC5792 and UNC4221, linked to Russian Intelligence Services including FSB officers and military personnel.

How the Attack Works

Earlier waves of the campaign targeted SMS verification codes and account PINs, or used doctored "group invite" links to silently link an attacker's device. The new technique is more insidious. Phishing messages, disguised as Signal support, walk targets through enabling Signal backups, opening the recovery key screen, and pasting the key into the chat. Once the attacker has the key, they can restore the account's backup, read all private and group message history, and take over the account.

Crucially, the compromised key remains valid even after the victim changes phones. If the target creates a new account with the same phone number, the old recovery key can still access future backups. The only fix is to generate a new recovery key in Signal's settings, which invalidates the old one for future downloads—but cannot undo any data already exfiltrated.

Technical Details and Sample Messages

The FBI published two sample phishing messages. One poses as a mandatory two-factor authentication rollout, the other as an urgent "data recovery" fix for messages supposedly at risk. Both exploit trust in Signal's own interface rather than technical vulnerabilities. The advisory emphasizes that these attacks do not break Signal's encryption. They are pure social engineering, targeting the user rather than the cryptography.

Who Is Targeted

Victims are individuals the FBI describes as of "high intelligence value": current and former US and international government officials, military personnel, political figures, journalists, and officials in Ukraine. The March advisory noted the broader campaign had already compromised thousands of accounts worldwide.

Mitigation and Response

If you receive a message inside Signal asking for a recovery key, verification code, or PIN, treat it as hostile. Signal does not message users inside the app to request credentials. To protect yourself, generate a new recovery key in Signal Settings > Account > Backup Recovery Key. This invalidates any previously shared key. The State Department's Rewards for Justice program is offering up to $10 million for information on UNC5792.

Broader Context

This campaign is part of a pattern. Google's Threat Intelligence Group first documented UNC5792 abusing Signal's linked-device feature in early 2025, and later observed the same tradecraft targeting WhatsApp and Telegram. The activity overlaps with earlier warnings from Dutch (AIVD, MIVD), German (BfV, BSI), and French (ANSSI) intelligence agencies. The takeaway: end-to-end encryption protects messages in transit, but cannot protect users who are persuaded to hand over the keys themselves.