SIT Reports: 🔍 Signal backup phishing shifts focus from account access to message archives A targeted...

Fast Alert Sensor Tier 3 Fast-alert source Situation-report fast-alert perspective Fast situation reports can outrun confirmation and should be cross-checked source-attributed Telegram source claim Public Telegram post fast-alert sensor global conflict situation reports

Public Telegram broadcast channel promoted after bounded no-media handle validation on 2026-05-31.

319 views 1 forwards 0 reactions Top 83.33% in source Source rank #26 Global pct 17.59

Original English English

🔍 Signal backup phishing shifts focus from account access to message archives

A targeted phishing campaign is sending SMS messages that impersonate Signal Support and pressure users to paste 64-character backup recovery keys into chat. The operation has been observed against journalists and activists and abuses Signal’s Secure Backups workflow; the stolen key can decrypt archived conversations stored on Signal servers. Signal does not request recovery keys from users.

Operationally, this is more damaging than a standard account takeover: the objective is retrospective access to full message history, not just future traffic. That makes high-risk users with sensitive archives a priority target set.

🛰️ Open sources - closed narratives
@sitreports

Telegram media item Media served by Telegram. The preview loads from telegram.org when this card is visible. Open original Telegram post