yuta/llm-wiki
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add

Browse Source
This commit is contained in:
yuta
2026-07-03 00:38:05 +09:00
parent 87eacd39b2
commit 86cad348b4
149 changed files with 24450 additions and 105 deletions
Download Patch File Download Diff File Expand all files Collapse all files
raw/articles/signal-backup-recovery-key-phishing-2026.md
+69
View File
@@ -0,0 +1,69 @@
---
source_url: "https://www.malwarebytes.com/blog/news/2026/05/signal-users-targeted-in-backup-stealing-phishing-attacks"
ingested: 2026-06-30
sha256: fb345e305901cc1ff4d00b52da3d97a36e07e25e6adabee577d5b0aa188c1359
discovered_from:
platform: discord
channel_id: "1477793137064935675"
channel_name: "tw"
message_id: "1521566444683268138"
author_id: "1477793167486226708"
posted_at: "2026-06-30T17:21:49.750000000Z"
message_excerpt: "Signal Backup Recovery Key 注意喚起: recovery keys and backups phishing/security operations context."
---
A new phishing campaign is targeting Signal users by attempting to steal their backup recovery keys to access encrypted message archives.
The attack is initiated by a text message pretending to come from Signal Support.
![Phishing message pretending to come from Signal support](https://www.malwarebytes.com/wp-content/uploads/sites/2/2026/05/text_message.png)
Phishing message pretending to come from Signal support
> “Action Required: Data Recovery Needed
> Your Signal account data (message and media) Is at risk of permanent loss due to a sync issue.
> To avoid losing your messages and media:
> 1\. Go to Settings -> Backups -> Configure -> Enable backups -> View Recovery Key.
> 2\. Copy the recovery key to your clipboard.
> 3\. Paste the key into this chat.
> This links your existing backup to your account. Failure to do this may result in losing access to your account and all stored data.”
There are a few red flags in this message:
- The “Name not verified” label under the sender
- Repeated threats of losing all your data
- Pasting the key into the chat. Signal Support would never ask for your recovery key
---
![](https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/11/phishing-scam-protection-icon-0B73D5.svg?w=1024)
### Scam or legit? Scam Guard knows.
---
The attack exploits Signal’s Secure Backups feature, which allows users to store encrypted archives of their conversations on Signal’s servers. These backups are protected by a 64-character recovery key.
That key should never leave the user’s device and is never shared with Signal’s servers. If hackers obtain this key and gain control of a victim’s account, they can download and decrypt the entire message history.
For an attacker, that’s even better than hijacking an account, which would only give them access to future messages.
For now, the attacks appear to be targeted. We have seen reports from [journalists, reports of attacks on Chinese activists](https://x.com/joshrogin/status/2059634806648930614), and warnings from a [researcher who investigates cyberattacks against journalists, dissidents, and human rights activists](https://techcrunch.com/2026/05/28/hackers-are-trying-to-steal-signal-users-backups-in-new-wave-of-phishing-attacks/). But now that other cybercriminals are aware of this opportunity, the tactic could spread rapidly.
## How to stay safe
Signal explicitly states that it will never reach out to users first and will never request registration codes, PINs, or recovery keys.
- **Treat unsolicited messages from “Support” as suspicious by default.** Legitimate support for apps like Signal and WhatsApp do not ask you, in a chat message, to send back verification codes, PINs, or passwords. If you receive a warning about account problems, do not follow links in the message. Open the app’s settings directly or visit the official website through other means.
- **Never share any secret codes, [multi-factor authentication keys](https://www.malwarebytes.com/cybersecurity/basics/2fa), or app PINs.** SMS codes are there to prove that you control a phone number. Anyone who has the code can pretend to be you. App‑specific PINs or passcodes are there to protect account changes. Consider anyone asking for them to be a scammer.
- **Use the extra security features these apps offer.** Enable options like [registration lock](https://support.signal.org/hc/en-us/articles/360007059792-Signal-PIN#manage_registration_lock), registration PIN and device‑change alerts so that your account cannot be silently re‑registered without an extra secret. Store your PIN in a password manager instead of choosing something easy to guess or reusing a code. This reduces the risk of social engineering or [shoulder‑surfing](https://en.wikipedia.org/wiki/Shoulder_surfing_\(computer_security\)).
- **Another useful feature is [disappearing messages](https://support.signal.org/hc/en-us/articles/360007320771-Set-and-manage-disappearing-messages).** Short‑timer and disappearing messages reduce how much content is available if an attacker gains access to a chat later, or obtains long‑term access to a device or backup. They are not a complete solution, but they can limit the damage.
- **Use [Malwarebytes Scam Guard](https://www.malwarebytes.com/solutions/scam-guard) on your device or online to check messages.** Malwarebytes Scam Guard identified this message as a phishing attempt and provided further information about how to proceed.
---
**Scammers know more about you than you think.**
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
[Download for iOS →](https://www.malwarebytes.com/ios) [Download for Android →](https://www.malwarebytes.com/android)