Hackers are trying to steal Signal users’ backups in new wave of phishing attacks

Previous hacking campaigns targeting Signal users attempted to hijack a victim’s account and then impersonate them, often with the potential goal of stealing the victim’s contacts or starting conversations with other people as if they were the account owner. In these cases, the hackers do not get access to past messages, since the attacks rely on them re-registering the victim’s account on a device they control. Because of how Signal is designed, older messages do not appear on the new device. 

Hackers can take over Signal accounts by hijacking someone’s phone number, for example. But Signal offers opt-in security features to protect against that attack such as Registration Lock, which prevents attackers from linking a target’s number to a new device unless they steal the target’s PIN. 

In that scenario, one way to see older messages would be to access a victim’s online backup, which requires the recovery key.

Last year, Signal launched Secure Backups, a new opt-in feature that lets users upload their account’s contents to Signal’s servers, which are encrypted with a recovery key that the organization says is “never shared with Signal’s servers,” and “never leaves” the users’ device. Signal says users should store the recovery key securely on a notebook or inside a password manager. 

“Without your unique recovery key, no one (including Signal) can read, decrypt, or restore any of the data in your Secure Backup Archive,” Signal said.

That means only the user can access their archive in a scenario where they register their account on a new phone, download the encrypted backup from Signal’s servers, and then decrypt it with the recovery key. 

Signal did not respond to a request for comment.