FBI and CISA warn Russian hackers can read Signal backups via recovery keys

The FBI and CISA just issued an updated advisory that targets a very specific weak spot in how Signal accounts can be recovered: Signal backup recovery keys. The warning is not about attackers magically breaking encryption. It is about attackers tricking people into handing over a key that can be used to restore a Signal account's backups, and then use that restored access to read what was backed up.

Published Thursday, the advisory describes a shift in how Russian intelligence hackers run phishing campaigns against Signal users. The key escalation is straightforward and nasty: handing over the recovery key once can allow attackers to restore the account's backup and read its contents. Even if the victim later changes phones, the attack can still work because the compromise is tied to the recovery key, not to a single device.