Signal Users Targeted in New Phishing Campaign

Hackers are targeting Signal users in an attempt to steal their chat backups as part of a new hacking campaign, TechCrunch has learned. Signal users are being tricked into sharing their recovery key with hackers, who are pretending to be the app's support team.

According to Washington Post analyst Josh Rogin, several anti-Chinese Communist Party activists have received this phishing attempt. Mohammed Al-Maskati, the director at Access Now’s Digital Security Helpline, also reported that two people shared similar messages with him.

How the Phishing Attempt Works

Hackers are sending messages to Signal users, warning them that their backed-up chats and media are “at risk of permanent loss due to a sync issue.” The message asks the user to share their recovery key, which is used to access their online backups in the chat. The hackers claim that this is necessary to avoid losing access to their account and all stored data.

Signal has publicly warned about this exact type of attack last month, stating that it “will never reach out” to users first and will never ask for their registration code, PIN, or recovery key.

Why This Attack is Different

Previous hacking campaigns targeting Signal users attempted to hijack a victim’s account and then impersonate them. In these cases, the hackers did not get access to past messages, as the attacks relied on them re-registering the victim’s account on a device they controlled. This new attack specifically targets backups, which can contain a victim’s older chats, photos, and documents.

What You Can Do to Protect Yourself

Signal users should be aware of this phishing attempt and not follow the instructions. The company has also warned users to store their recovery key securely on a notebook or inside a password manager. Additionally, users should be cautious when receiving messages from unknown or unverified sources, especially if they are asking for sensitive information.

Signal’s Secure Backups Feature

Signal launched Secure Backups last year, a new opt-in feature that lets users upload their account's contents to Signal's servers. The recovery key is encrypted and never leaves the user's device. Without the recovery key, no one, including Signal, can read, decrypt, or restore any of the data in the user's Secure Backup Archive.

Conclusion

The new phishing campaign targeting Signal users is a reminder of the importance of online security and the need to be cautious when receiving messages from unknown or unverified sources. Users should be aware of this phishing attempt and take steps to protect themselves and their data.