--- title: FBI says Russian spies now trick Signal users into... description: The FBI and CISA have issued a warning that Russian intelligence hackers (tracked as UNC5792 and UNC4221) are phishing Signal users to steal their backup... canonical: https://daily.dev/posts/fbi-says-russian-spies-now-trick-signal-users-into-handing-over-their-backup-recovery-key-jzexwxtct twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: FBI says Russian spies now trick Signal users into handing over their backup recovery key | daily.dev og:description: The FBI and CISA have issued a warning that Russian intelligence hackers (tracked as UNC5792 and UNC4221) are phishing Signal users to steal their backup... og:url: https://daily.dev/posts/fbi-says-russian-spies-now-trick-signal-users-into-handing-over-their-backup-recovery-key-jzexwxtct og:image: https://api.daily.dev/og/posts/jZEXWXTct.png og:image:alt: FBI says Russian spies now trick Signal users into handing over their backup recovery key og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # FBI says Russian spies now trick Signal users into handing over their backup recovery key **[The Next Web](https://daily.dev/sources/tnw)** · 3 min read · 0 upvotes · 0 comments ## Summary The FBI and CISA have issued a warning that Russian intelligence hackers (tracked as UNC5792 and UNC4221) are phishing Signal users to steal their backup recovery keys. Once obtained, the key gives attackers persistent access to a victim's full message history and account, even after a phone change. The phishing messages impersonate Signal support, posing as mandatory 2FA rollouts or urgent data recovery notices, and walk targets through revealing their recovery key. Targets include government officials, military personnel, journalists, and Ukrainian officials. The attack does not break Signal's encryption — it exploits users through social engineering. The only mitigation is generating a new recovery key in Signal's settings. Signal never contacts users inside the app to request credentials. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [FBI: Russian hackers now target Signal backup recovery keys](https://daily.dev/posts/fbi-russian-hackers-now-target-signal-backup-recovery-keys-wto8mjgyk) · BleepingComputer · 0 upvotes · 0 comments - [Hackers are trying to steal Signal users’ backups in new wave of phishing attacks](https://daily.dev/posts/hackers-are-trying-to-steal-signal-users-backups-in-new-wave-of-phishing-attacks-wqsdhziyz) · TechCrunch · 0 upvotes · 0 comments - [Signal Phishing and Russian Intelligence Targeting Messaging Apps](https://daily.dev/posts/signal-phishing-and-russian-intelligence-targeting-messaging-apps-cqkn6o6va) · Security Boulevard · 0 upvotes · 0 comments - [A spyware investigator exposed Russian government hackers trying to hijack Signal accounts](https://daily.dev/posts/a-spyware-investigator-exposed-russian-government-hackers-trying-to-hijack-signal-accounts-2rpemsuf9) · TechCrunch · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#phishing](https://daily.dev/tags/phishing), [#encryption](https://daily.dev/tags/encryption) [View this post on daily.dev](https://daily.dev/posts/fbi-says-russian-spies-now-trick-signal-users-into-handing-over-their-backup-recovery-key-jzexwxtct) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"FBI says Russian spies now trick Signal users into handing over their backup recovery key","url":"https://daily.dev/posts/fbi-says-russian-spies-now-trick-signal-users-into-handing-over-their-backup-recovery-key-jzexwxtct","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fbi-says-russian-spies-now-trick-signal-users-into-handing-over-their-backup-recovery-key-jzexwxtct"},"datePublished":"2026-06-27T15:21:03.909Z","dateModified":"2026-06-27T15:21:30.870Z","description":"The FBI and CISA have issued a warning that Russian intelligence hackers (tracked as UNC5792 and UNC4221) are phishing Signal users to steal their backup...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ec0a6d6e8a42077eb515054b09bcd32b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ec0a6d6e8a42077eb515054b09bcd32b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fbi-says-russian-spies-now-trick-signal-users-into-handing-over-their-backup-recovery-key-jzexwxtct","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,phishing,encryption","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"FBI says Russian spies now trick Signal users into handing over their backup recovery key"}]} ```