Dutch AIVD and MIVD Warn Russian State Hackers Shifted to Stealing Signal Backup Recovery Keys in Ongoing Espionage Campaign

The Dutch MIVD and AIVD said Monday that Russian state hackers have shifted tactics against Signal accounts, moving from stealing verification codes to phishing for Signal Backup Recovery keys, and that the agencies corroborate a warning US services issued on June 26 based on their own research 12. The attackers send messages posing as "Signal Support" and create false urgency to induce targets to hand over the 64-character recovery key, which lets them download full message histories, photos, and documents from the past 45 days or take full control of the account; agencies advise anyone who shared a key to generate a new one immediately, which invalidates it for future backups but cannot undo access to data already downloaded 23. MIVD and AIVD first warned on March 9 that Russia was targeting Signal and WhatsApp accounts of Western and Ukrainian officials, government employees, military personnel, and journalists, and both agencies said the campaign remains large-scale and successful, with attackers obtaining sensitive information, including messages belonging to Dutch government employees 124. MIVD Director Vice Admiral Peter Reesink said encrypted apps like Signal and WhatsApp are unsuitable for confidential communication despite their encryption, while AIVD Director-General Simone Smit said the new method shows attackers continually adapting; both agencies stressed the Signal app itself has not been compromised, only individual accounts 12.