New Russian-Linked Signal Phishing Tactic Puts Encrypted Chats at Risk
U.S. authorities are warning that hackers tied to Russian intelligence are using a new phishing tactic to steal Signal backup keys, potentially letting them restore victims’ encrypted message history and hijack accounts. The campaign targets government, diplomatic, and tech-sector users — turning one of the world’s most trusted messaging apps into an attack surface for espionage rather than a shield against it.
One of the core promises of secure messaging — that even powerful states cannot easily read your conversations — is being tested not by breaking encryption, but by tricking people into handing over the keys themselves.
On 26 June, cybersecurity alerts described a new phishing technique attributed to actors linked to Russian intelligence that aims squarely at users of Signal, the widely used end‑to‑end encrypted messaging app. According to U.S. law enforcement and cybersecurity agencies, the attackers are contacting targets and asking them to share their Signal Backup Recovery Key, the long code that allows users to restore their message history on a new device.
If the phishing succeeds and the attackers obtain that key, they can restore old backups, read past message histories, and effectively take over the victim’s Signal account. This does not involve breaking Signal’s encryption, but rather abusing an account recovery feature that is only as secure as the user’s willingness to keep the recovery key secret. The warnings say the campaign has struck at government, diplomatic, and software development organizations in multiple countries.
For the people and institutions being targeted, the stakes are obvious. Diplomatic cables, internal government deliberations, and sensitive commercial negotiations increasingly flow through encrypted messaging apps rather than traditional email. A stolen backup key can expose months or years of conversations, revealing not only content but also patterns of contact and timing that are valuable for intelligence analysis and coercion.
This kind of operation is designed to exploit trust in familiar tools. Signal’s reputation as a privacy‑preserving platform may make some users less suspicious when a message appears to come from a colleague or a legitimate support channel. The attackers’ goal is to blur that line just enough, often by combining the Signal lure with other techniques like malicious installers or document files that deliver payloads such as Cobalt Strike Beacon — a tool commonly repurposed by state and criminal actors for deep network penetration.
The broader campaign, dubbed StrikeShark by researchers, reportedly uses a custom downloader known as SharkLoader to deploy Cobalt Strike in targeted environments. Publicly known software vulnerabilities, tampered installers, and DLL hijacking are among the vectors used to gain a foothold before or alongside the Signal‑focused social engineering. Once inside a network, attackers can move laterally, exfiltrate documents, and establish persistent access.
Strategically, the operation illustrates how modern espionage blends technical exploits with psychological manipulation. Rather than sink years into breaking well‑audited encryption algorithms, state-linked actors are concentrating effort on the much softer target: human behavior and the often-overlooked settings that stand between a user and their data. For governments and companies that have encouraged staff to shift sensitive discussions onto encrypted apps, this is a reminder that policy cannot end at installation.
The practical risk is twofold. On one level, compromised Signal accounts can expose individual conversations that put activists, journalists, or officials in danger. On another, they can serve as stepping stones into larger systems, as attackers use trust in one compromised account to send convincing phishing messages to others.
Signs to watch going forward include whether the phishing technique spreads beyond high‑value targets to broader segments of Signal’s user base, whether other messaging platforms report similar backup‑key scams, and how quickly organizations tighten their guidance and technical controls around account recovery features that now sit at the center of a high‑end espionage campaign.
Sources
- OSINT