FBI and CISA warn Russian phishing for Signal backup keys

U.S. federal agencies have issued an updated warning that Russian intelligence services are conducting an ongoing phishing campaign targeting users of the Signal messaging application, with attackers now focused on stealing victims' backup recovery keys to access entire message histories. The Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency detailed the evolution of the campaign in a public service announcement published on June 26, 2026, which builds on an initial advisory from March.

The campaign specifically targets individuals deemed of high intelligence value, including current and former U.S. and international government officials, military personnel, political figures, journalists, and officials in Ukraine. The activity is publicly tracked under the names UNC5792 and UNC4221 and is attributed to multiple Russian Intelligence Services groups, including officers embedded with the Federal Security Service Border Guards and other actors working on behalf of Russian military services.

While earlier phishing attempts sought to steal one-time verification codes or account PINs, the updated tactics involve attackers impersonating Signal...