{"id":242974,"date":"2026-05-28T19:07:24","date_gmt":"2026-05-28T19:07:24","guid":{"rendered":"https:\/\/entertainment.runfyers.com\/index.php\/2026\/05\/28\/hackers-are-trying-to-steal-signal-users-backups-in-new-wave-of-phishing-attacks-techcrunch\/"},"modified":"2026-05-28T19:07:24","modified_gmt":"2026-05-28T19:07:24","slug":"hackers-are-trying-to-steal-signal-users-backups-in-new-wave-of-phishing-attacks-techcrunch","status":"publish","type":"post","link":"https:\/\/entertainment.runfyers.com\/index.php\/2026\/05\/28\/hackers-are-trying-to-steal-signal-users-backups-in-new-wave-of-phishing-attacks-techcrunch\/","title":{"rendered":"Hackers are trying to steal Signal users’ backups in new wave of phishing attacks | TechCrunch"},"content":{"rendered":"


\n<\/p>\n

\n

Hackers are targeting Signal users in an attempt to steal their chat backups as part of a new hacking campaign, TechCrunch has learned.\u00a0<\/p>\n

On Wednesday, Washington Post analyst Josh Rogin posted a screenshot<\/a> of a new kind of attack against Signal users, where hackers pretend to be the app\u2019s support team and warn the target that their backed-up chats and media are \u201cat risk of permanent loss due to a sync issue.\u201d To avoid that, the message said, the target needs to share the recovery key that is used to access their online backups in the chat with the hackers.\u00a0<\/p>\n

\u201cThis links your existing backup to your account. Failure to do this may result in losing access to your account and all stored data,\u201d read the message purporting to come from an account called Signal Support.<\/p>\n

\n
\n
\n

This is a phishing attempt. If you get this message on Signal, do not follow the instructions. Many anti-CCP activists have also received this phishing attempt. Beware and be aware. pic.twitter.com\/8J1YDcpUAX<\/a><\/p>\n

\u2014 Josh Rogin (@joshrogin) May 27, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n

Rogin said that several anti-Chinese Communist Party activists have received this malicious message.\u00a0<\/p>\n

Mohammed Al-Maskati\u2069, the director at Access Now\u2019s Digital Security Helpline<\/a>, which investigates cyberattacks against journalists, dissidents, and human rights activists, told TechCrunch that two people shared similar messages with him. Al-Maskati said that the two are not Chinese activists. This suggests that the hacking campaign could be more widespread and targeting other communities, or there may be different groups of hackers using the same strategy.<\/p>\n

It\u2019s not clear how effective the hacking campaign has been. Al-Maskati said that stealing the victim\u2019s recovery keys for their chat backups is only one step in the attack, and that the hackers still have to take over the victim\u2019s account.\u00a0<\/p>\n

In general, this type of attack relies on phishing<\/a> targets, meaning tricking them into sharing some important and private information with the hackers. In this particular case, the hackers are pretending to be Signal\u2019s support team to exploit the target\u2019s trust in the app and the organization behind it. <\/p>\n

It\u2019s important to note that Signal says<\/a> it \u201cwill never reach out\u201d to users first, and will never ask<\/a> for their registration code, PIN, or recovery key. That means any chat pretending to be coming from \u201cSignal Support\u201d is actually coming from malicious hackers. The organization publicly warned<\/a> about this exact type of attack last month.\u00a0<\/p>\n

\n

Contact Us<\/h4>\n

\t\t\tDo you have more information about these attacks against Signal users? Or other similar attacks? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email<\/a>.<\/a>\t\t<\/div>\n

While there have been several campaigns of hackers<\/a> impersonating<\/a> Signal support in recent months, this is a new type of attack because it specifically targets backups, which can contain a victim\u2019s older chats, photos, and documents.\u00a0\u00a0<\/p>\n

Previous hacking campaigns targeting Signal users attempted to hijack a victim\u2019s account and then impersonate them, often with the potential goal of stealing the victim\u2019s contacts or starting conversations with other people as if they were the account owner. In these cases, the hackers do not get access to past messages, since the attacks rely on them re-registering the victim\u2019s account on a device they control. Because of how Signal is designed, older messages do not appear on the new device.\u00a0<\/p>\n

Hackers can take over Signal accounts by hijacking someone\u2019s phone number, for example. But Signal offers opt-in security features to protect against that, such as Registration Lock<\/a>, which prevents attackers from linking a target\u2019s number to a new device unless they steal the target\u2019s PIN.\u00a0<\/p>\n

In that scenario, one way to see older messages would be to access a victim\u2019s online backup, which requires the recovery key. <\/p>\n

Last year, Signal launched Secure Backups<\/a>, a new opt-in feature that lets users upload their account\u2019s contents to Signal\u2019s servers, which are encrypted with a recovery key that the organization says is \u201cnever shared with Signal\u2019s servers,\u201d and \u201cnever leaves\u201d the users\u2019 device. Signal says<\/a> users should store the recovery key securely on a notebook or inside a password manager.\u00a0<\/p>\n

\u201cWithout your unique recovery key, no one (including Signal) can read, decrypt, or restore any of the data in your Secure Backup Archive,\u201d Signal said.<\/p>\n

That means only the user can access their archive in a scenario where they register their account on a new phone, download the encrypted backup from Signal\u2019s servers, and then decrypt it with the recovery key.\u00a0<\/p>\n

Signal did not respond to a request for comment.<\/p>\n<\/div>\n

When you purchase through links in our articles, we may earn a small commission<\/a>. This doesn\u2019t affect our editorial independence.<\/em><\/p>\n