Hackers are abusing Signal’s in‑app messaging to trick users into giving up their backup recovery keys, allowing attackers to unlock years of supposedly private conversations in a new phishing wave.
The campaign uses messages that appear to come from “Signal Support” and warn of imminent data loss. However, they are fraudulent and designed to steal victims’ encrypted chat backups.
Victims receive a direct message from an account named “Signal Support,” marked with a “Name not verified” warning and generic safety tips inside the app.
The message claims “Action Required: Data Recovery Needed” and states that the user’s account data is at risk of permanent loss due to a sync issue, urging them to act quickly to avoid losing messages and media.
It then instructs users to open Signal’s Settings, navigate to Backups, view their recovery key, copy it to the clipboard, and paste it back into the chat.
The text falsely says this will “link your existing backup” to the account and warns that failure to comply may result in losing access to all stored data, adding pressure and urgency typical of phishing attacks.
In reality, this operation has no connection to Signal’s real support team, and there is no backup sync issue affecting targeted users.
gbhackers.com
watching.