Hackers target Signal users with phishing attacks to steal backups
TL;DR. A new phishing campaign aims to trick Signal users into revealing their secret recovery keys to access message backups. - Malicious actors are impersonating Signal support, asking users to verify their accounts. - The attackers exploit Google search ads to spread fake Signal app downloads. - Signal does not have access to user message histories, emphasizing the importance of securing local backups.
- Hackers impersonating Signal support are using phishing tactics.
- The primary goal is to obtain users' secret recovery keys for message backups.
- Attackers are distributing fake Signal apps via compromised Google search ads.
- Signal warns users that it never requests recovery keys or account verification.