Hackers are conducting phishing attacks to steal Signal users' secret recovery keys, which grant access to encrypted message backups stored online.
The campaign targets users by attempting to trick them into revealing their recovery keys—credentials that unlock backups containing past conversations.
Signal's backup feature allows users to store encrypted message histories in the cloud. The recovery key serves as the master credential for accessing these backups. If compromised, attackers gain access to potentially sensitive historical messages.
The phishing attacks use social engineering tactics to manipulate users into voluntarily disclosing their keys. Security researchers recommend users:
- Never share recovery keys with anyone, including Signal support staff
- Be suspicious of unsolicited messages requesting credentials
- Verify requests through official Signal channels
- Store recovery keys securely offline
Signal has not released details on the attack's scale or distribution method. The messaging platform emphasizes that legitimate requests for recovery keys should raise immediate red flags, as authorized personnel never ask users to share them.
SAP released security updates for 16 vulnerabilities in July 2026, including three critical flaws affecting NetWeaver, Commerce Cloud, and AppRouter. The patches address risks across multiple enterprise software components.
Two newly discovered phishing kits, Jalisco and OmegaLord, are actively targeting Microsoft 365 accounts with techniques designed to circumvent multi-factor authentication protections.
The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned two individuals and one entity for enabling ransomware attacks against American organizations. The action targets infrastructure providers facilitating cyber threats.
As scam calls and messages proliferate, ordinary people are turning the tables on fraudsters through scambaiting—deliberately engaging scammers to waste their time and resources.