SAN FRANCISCO — Hackers launched a phishing campaign on or before May 27, 2026, targeting Signal users by impersonating 'Signal Support' to steal recovery keys for encrypted chat backups. The phishing messages warned recipients that their backed-up chats and media were 'at risk of permanent loss due to a sync issue' and instructed them to share their recovery key to avoid losing access to their account and stored data.

Josh Rogin, an analyst, posted a screenshot of one such message on May 27 and stated that several anti-Chinese Communist Party activists received the phishing attempt. Mohammed Al-Maskati, director at Access Now’s Digital Security Helpline, said that two people shared similar phishing messages with him. Al-Maskati added that the two individuals who shared the messages are not Chinese activists.

Al-Maskati explained that stealing the victim’s recovery key is only one step in the attack, and hackers still need to take over the victim’s account. Hackers can take over Signal accounts by hijacking a user’s phone number. Signal’s design prevents older messages from appearing on a new device when an account is re-registered by an attacker, and previous campaigns targeting Signal users attempted to hijack accounts and impersonate victims without gaining access to past messages.

Signal launched Secure Backups in 2025, an opt-in feature that lets users upload encrypted account contents to Signal’s servers using a recovery key that never leaves the user’s device. Accessing a victim’s online backup requires the recovery key, and Signal states that without the user’s unique recovery key, no one—not even Signal—can read, decrypt, or restore data in the Secure Backup Archive.

Signal states it will never reach out to users first and will never ask for their registration code, PIN, or recovery key. The company publicly warned about this type of phishing attack last month and recommends users store their recovery key securely in a notebook or password manager. Signal also offers an opt-in security feature called Registration Lock that prevents attackers from linking a target’s number to a new device without the target’s PIN. Signal president Meredith Whittaker said, 'We’re working on mitigations here, and monitoring.'