New Signal Hack Targets Chat Backups Via Fake Support

A recent hacking campaign has emerged, targeting Signal users with the aim of stealing their encrypted chat backups. Attackers are posing as Signal support staff, falsely informing recipients that their backups are at risk due to sync issues. To resolve this fabricated problem, victims are prompted to share their recovery keys, which are crucial for accessing online chat archives.

This phishing tactic exploits user trust in the Signal application. While some anti-Chinese Communist Party activists have reported receiving these messages, the campaign may be more widespread, potentially targeting other communities. Stealing the recovery key is only one step; hackers would still need to compromise the user's account.

Signal reiterates that it never contacts users first or requests registration codes, PINs, or recovery keys. Last month, the organization issued a public warning about such impersonation attacks. Unlike previous campaigns that focused on hijacking active accounts, this new strategy specifically targets the Secure Backups feature, launched last year.

Signal's Secure Backups, an opt-in feature, encrypts user data with a recovery key that remains exclusively on the user's device. Without this unique key, neither Signal nor anyone else can decrypt or restore the backup data. Users are advised to store their recovery keys securely offline or in a password manager.