Signal is one of the most secure encrypted communication platforms available, but that doesn’t mean it’s impenetrable against bad actors. Earlier this year, for example, the FBI was able to recover deleted Signal messages from a defendant’s iPhone thanks to a vulnerability in how notifications are stored. (Apple has since patched this flaw.) Now, the app is a target for hackers, who are impersonating Signal’s support team in a sophisticated phishing scam aimed at gaining access to secure chat backups. Here’s what you need to know to protect your Signal account.
How the latest Signal scam works
As TechCrunch reports, threat actors are using an account titled “Signal Support” to send phishing messages to prospective targets requesting the recipient’s recovery key. The message warns that backup messages and media are “at risk of permanent loss due to a sync issue,” and unless the user provides their recovery key to the “support” team, they may lose access to their account and its data. Of course, this is all a lie: With your recovery key, attackers can unlock your encrypted chat backups, which is their explicit goal here.
This phishing campaign may largely target activists and other high-risk Signal users like journalists. However, some experts have suggested that the tactic may be used more widely and by multiple threat actors, who are exploiting users’ trust in the app’s reputation for privacy and security. The platform also recently warned users about similar support impersonation scams aimed at account takeover. Signal will never ask you for your account details, like your PIN or recovery key, and any such requests from so-called support are a scam.
What do you think so far?
Protect your Signal account now
If you receive a message from Signal Support or any official-looking user requesting credentials or keys, do not provide this information. These are hackers impersonating Signal, not trusted accounts. No legitimate company or platform will contact you out of the blue asking for your login or other sensitive data. You should also enable Registration Lock, Signal’s security feature that protects your account from being hijacked. Registration Lock prevents someone else from setting up Signal on a new device (without an additional PIN) and then locking you out. Go to Settings > Account and toggle Registration Lock on to ensure you won’t be attacked like this.
