The FBI and CISA have updated their warning about Russian intelligence phishing Signal accounts, revealing a new tactic that involves coercing targets into handing over their Signal Backup Recovery Key. This key allows attackers to restore the account's backup, access private and group message history, and take control of the account. Notably, the key remains active even after a new account is created on the same phone number, making it a persistent threat. To mitigate this, users can generate a new key in Settings, which invalidates the old one and prevents future backup downloads. However, any data already accessed by the attacker will be lost. The campaign, attributed to multiple Russian Intelligence Services groups, targets high-value individuals, including current and former government officials, military personnel, and journalists. The phishing messages pose as Signal support, walking targets through the process of enabling backups and sharing the Recovery Key. The updated advisory emphasizes that these attacks compromise individual accounts through social engineering, rather than exploiting vulnerabilities in Signal's encryption or the app itself. To protect themselves, users should be cautious of in-app messages from 'Signal support', never share their Backup Recovery Key or verification codes, and regularly review linked devices in their Settings. If a user suspects they have handed over their Recovery Key, they should generate a new one immediately and assume any previous backups are compromised.

Source: The Hackers News