GoKawiilThe FBI and CISA are warning that a phishing campaign targeting Signal users tied to Russian intelligence services has evolved to steal Signal Backup Recovery Keys, allowing attackers to access victims' historical messages.
The updated public service announcement is an update to a March 2026 advisory that warned the threat actors were targeting users of commercial messaging applications, particularly Signal, through phishing campaigns designed to hijack accounts rather than break end-to-end encryption.
"RIS cyber threat actors continue to masquerade as automated CMA support accounts in updated phishing messages but have evolved their tactics to attempt to elicit victims' Backup Recovery Keys," warns an FBI PSA published today.
According to the FBI, the campaign continues to target individuals of high intelligence value, including current and former US and international government officials, military personnel, political figures, journalists, and key officials located in Ukraine.
The agencies attribute the activity to Russian Intelligence Services (RIS), including officers embedded with Russia's Federal Security Service (FSB) Border Guards and other actors working on behalf of the Russian military. The campaign is publicly tracked as UNC5792 and UNC4221.
New phishing tactic targets Signal backups
While the original advisory focused on phishing messages that attempted to steal verification codes or account PINs, or to trick users into linking attacker-controlled devices to their Signal accounts, the updated alert says the attackers have evolved their tactics.
The FBI says the threat actors continue to impersonate Signal support teams, sending phishing messages that falsely claim Signal is introducing mandatory two-factor verification following an alleged wave of attacks by hackers from Iran and post-Soviet countries.
"Recently, attempts to hack users of our messenger with the connection of third-party devices to the account have become more frequent," reads the initial phishing message.
"An investigation conducted jointly with the US government and European partners revealed that the attacks on accounts were carried out by hackers from Iran and post-Soviet countries. In this regard, Signal updates Terms of Service & Privacy Policy, and introduces Mandatory Two-factor Verification for users."
... continue reading