The FBI and CISA have issued a warning that Russian intelligence hackers (tracked as UNC5792 and UNC4221) are phishing Signal users to steal their backup recovery keys. Once obtained, the key gives attackers persistent access to a victim's full message history and account, even after a phone change. The phishing messages impersonate Signal support, posing as mandatory 2FA rollouts or urgent data recovery notices, and walk targets through revealing their recovery key. Targets include government officials, military personnel, journalists, and Ukrainian officials. The attack does not break Signal's encryption — it exploits users through social engineering. The only mitigation is generating a new recovery key in Signal's settings. Signal never contacts users inside the app to request credentials.
