Hackers are reportedly targeting users of Signal in a new phishing campaign aimed at stealing chat backups and sensitive account data.

According to reports, cybercriminals are disguising themselves as Signal’s support team and sending fake warning messages claiming that users’ backed-up chats and media are at risk of being permanently lost due to a supposed sync issue.

The fraudulent messages instruct victims to share their recovery key, which is required to access encrypted online backups stored on Signal’s servers.

The fake alert reads in part: “This links your existing backup to your account. Failure to do this may result in losing access to your account and all stored data.”

Washington Post analyst Josh Rogin disclosed that several anti-Chinese Communist Party activists received the phishing messages, raising concerns that the attack may be politically motivated.

Digital security expert Mohammed Al-Maskati also confirmed receiving reports from other victims outside activist circles, suggesting the campaign could be broader and targeting multiple communities.

Signal President Meredith Whittaker said the company is monitoring the attacks and working on protective measures.

Signal has repeatedly warned users that the company will never contact them first to request registration codes, PINs, or recovery keys.

Experts explained that the attackers rely on phishing tactics to trick users into voluntarily revealing private information needed to access their encrypted backups.

Unlike previous attempts that mainly focused on hijacking phone numbers to take over accounts, this latest strategy specifically targets Signal’s Secure Backups feature, which stores older chats, photos, videos, and documents in encrypted form.

Signal introduced the Secure Backups feature last year as an opt-in service that allows users to safely store account data online using a unique recovery key that remains only on the user’s device.

The company stressed that without the recovery key, nobody — including Signal itself — can access or decrypt a user’s backup archive.

Security experts have therefore advised users never to share their recovery keys, PINs, or verification codes with anyone, regardless of how legitimate the message may appear.