Phishing Campaign Targets Signal Users' Backup Recovery Keys

Signal is widely used by journalists, activists, lawyers, and government officials who require secure communications. The app's end-to-end encryption has historically made direct interception impractical, prompting adversaries to pursue indirect methods such as compromising backups or device access instead. Signal's backup feature allows users to transfer message histories across devices using a recovery key - a value that, if stolen, can unlock stored message archives outside the app's encryption protections. This style of credential-focused phishing, targeting recovery or authentication keys rather than passwords, has become an increasingly common tactic against high-value targets.