The New Threat: Signal Backup Keys Under Attack

According to a report from The Hacker News, the FBI and CISA have updated their warning about Russian intelligence groups targeting secure messaging apps. The attackers are now tricking victims into handing over their Signal Backup Recovery Key, a feature designed to restore message history.

This shift matters because the recovery key gives attackers lasting access. Even if the target changes their phone number or creates a new account, the old key can still pull up the backup. The attack does not break Signal’s encryption — it exploits a person’s willingness to share a legitimate feature.

Why This Tactic Is So Dangerous

The phishing messages look like official support requests. They ask users to turn on backups, open the recovery key, and paste it into the chat. Once the key is shared, the attacker can read all past and future messages tied to that backup.

This is a social engineering attack, not a technical flaw. It targets the human element, which is often the weakest link. For Australian businesses, the lesson is clear: even secure tools become unsafe when users are tricked into handing over the keys.

What This Means for Australian SMBs

Small and mid-sized businesses in Australia may not believe they are targets of international intelligence campaigns. But cyber criminals and state-backed groups often use smaller companies as stepping stones to reach larger organisations or to gather intelligence on partners and clients.

Any business that uses Signal for internal communication or client discussions should take this warning seriously. A single compromised account can expose sensitive business plans, customer data, or financial details. Australian SMBs must treat these threats as real and relevant to their operations.

What You Can Do Now

  • Never share your Signal Backup Recovery Key, verification code, or PIN in any chat, even if the message appears to come from "Signal Support." Official support will never ask for these inside the app.
  • Regularly check your Signal settings for linked devices. Remove any device you do not recognise immediately.
  • If you suspect you have handed over your recovery key, generate a new one in the app settings right away. This invalidates the old key for future access.
  • Enable a strong Signal PIN and consider using registration lock to prevent someone from moving your account to another phone without your permission.
  • Train your staff to recognise phishing messages that ask for account recovery details, even if they look urgent or official.

At MS&VG, we help Australian businesses stay ahead of evolving cyber threats with practical security advice and managed solutions. If you are unsure about your messaging app security, talk to our team for a quick assessment.