THE FBI has issued a warning that Russian intelligence is running a phishing campaign aimed at stealing Signal backup recovery keys as detailed in the latest IC3 PSA. The operation seeks to obtain the 30‑digit key that allows indefinite access to a user’s message history and account settings.
The phishing messages pretend to come from official Signal support and guide the victim through a fake recovery process according to Security Affairs. Unlike a one‑time SMS verification code, the recovery key does not expire, so once it is disclosed the attacker can retain long‑term control of the account.
The campaign was first observed on 26 June 2026 and continued through the following day, with no associated CVE identifiers. Threat actors have not been publicly attributed beyond the generic label of Russian intelligence, and Signal’s end‑to‑end encryption remains unbroken.
Security analysts note the shift from targeting SMS verification codes to focusing on recovery keys reflects an evolution in social engineering tactics used by state‑sponsored groups. This change increases the potential damage because compromised keys enable persistent surveillance of conversations.
Individuals should treat their Signal recovery key like a password and never share it in response to unsolicited messages, even if they appear to come from Signal. Any request for the key should be verified through the official Signal app or website, and suspicious communications can be forwarded to the IC3 for investigation.
Organisations are advised to run regular phishing awareness training that includes the specific lure of recovery‑key theft, enforce the use of registration locks and device‑level PINs on Signal, and monitor accounts for unfamiliar linked devices. Keeping backups of recovery keys offline and separate from everyday devices further reduces the risk of compromise.