FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys

The FBI and CISA updated a March advisory warning that Russian intelligence-linked operators (tracked as UNC5792 and UNC4221) are phishing Signal users to obtain their Backup Recovery Key; with the key attackers can restore backups, read message history, and hijack accounts. The campaign targets high-value individuals worldwide, has compromised thousands of accounts, and agencies advise never sharing recovery keys or codes, removing unknown linked devices, and generating a new recovery key if compromise is suspected.