Signal phishing 2026: hackers target recovery keys

What has changed: the new wave of phishing against Signal

In late May 2026, TechCrunch documented a phishing campaign aimed at Signal users. The target is the secret recovery key, the secret key that lets you restore the app's online backups. Whoever holds it can read the entire conversation history.

So this is not an attack on Signal's end-to-end encryption. Instead, hackers bypass the technical protection by exploiting human error. They send messages or notifications that imitate the app's official communications. Then they redirect the user to fake pages that ask for the recovery key.

What's more, phishing pages have become more sophisticated. Fake sites faithfully replicate Signal's interface. As a result, even experienced users can be fooled if they aren't extremely careful.

Why Italian SMEs are more exposed than they think

Signal is widely used in professional settings too. Many small and medium-sized businesses rely on it for confidential internal communications: sales negotiations, exchanges with lawyers, coordination among partners. Retail and B2B SMEs in particular adopt it as a privacy-minded alternative to WhatsApp.

However, using consumer apps for business carries specific risks. Company security policies rarely cover the management of messaging app recovery keys. So a single deceived employee can expose conversations involving the entire organization.

In fact, according to the Gartner Cybersecurity Research Hub, social engineering attacks account for over 70% of data breaches in mid-sized organizations. Likewise, SMEs are favorite targets because they have limited cybersecurity resources.

Beyond that, the damage isn't only technical. A compromise of business conversations can have legal, reputational and competitive consequences. That's why the issue deserves immediate attention, even from those who don't work in IT.

How the attack works: the theft of the recovery key

Signal's secret recovery key is an alphanumeric sequence generated when cloud backups are activated. It is used to encrypt and decrypt archived messages. Without it, the backups are inaccessible, even to Signal itself.

Attackers work in three main stages. First, they send a message that looks like a security alert from Signal. It reports suspicious access or the need to verify your account. Next, the link in the message leads to a page identical to the official interface.

Finally, the page asks you to enter the recovery key to "confirm your identity." At that point, the key is sent to the attackers' servers. As a result, they can access the cloud backup and download the entire message archive.

Still, Signal never sends messages asking for the recovery key. This is the clearest warning sign. Any request of this kind should be treated as a fraud attempt.

Immediate operational impact for businesses using Signal

The implications for an SME are concrete. A compromised backup can contain quotes, draft contracts, supplier discussions and customer data. So the exposure goes far beyond the personal sphere of the affected user.

Moreover, under the GDPR, losing control of third-party personal data (customers, employees, partners) may constitute a breach that must be reported to the Garante within 72 hours. SMEs must therefore assess this risk from a regulatory compliance standpoint as well.

For this reason, we at SHM Studio suggest treating the security of communication apps as an integral part of your digital strategy. It's not just about technology. It's about protecting your company's information assets.

What to do now: three concrete actions for SMEs

The measures to adopt don't require advanced technical skills. They are organizational steps any company can take.

• Train your staff to spot phishing. A 30-minute briefing on social engineering techniques significantly reduces risk. It helps to show real examples of fraudulent Signal-related messages.
• Revoke and regenerate the recovery key. Anyone who suspects they entered their key on an unofficial site should regenerate it immediately in Signal's settings. That way, the old backup becomes inaccessible to attackers.
• Define a policy on using consumer apps for work. Establish which tools are approved for business communications and which procedures to follow for managing credentials. Also, appoint an internal contact for reporting suspected incidents.

It's also worth considering communication tools designed specifically for business, with centralized access management and built-in security policies.

The bigger picture: phishing and digital security in 2026

This attack on Signal is not an isolated episode. According to the McKinsey Global Institute, phishing remains the most common attack vector worldwide. In 2025, there was already a significant increase in attacks targeting encrypted messaging apps.

The trend is clear: attackers are shifting toward human and organizational weak points, not technical vulnerabilities. So investing only in firewalls and antivirus software isn't enough. Training and internal procedures are just as critical.

In this scenario, an SME's digital strategy must also include security. Protecting your communication channels means protecting your online reputation, customer trust and business continuity.

What nobody tells you: security as a competitive edge

There's an aspect often overlooked in the cybersecurity debate for SMEs. Security isn't just a cost to bear. On the contrary, it can become a source of competitive differentiation.

In fact, B2B customers increasingly assess suppliers' reliability in terms of data protection too. An SME that demonstrates secure, transparent processes builds trust faster. Likewise, avoiding security incidents preserves your online reputation, an asset directly tied to search engine visibility and digital credibility.

That's why building security into your SEO strategy and digital communication is not a contradiction. It's a mature vision of modern marketing. Companies that manage their data well communicate better. Those that communicate better convert more.

Outlook: what to expect in the coming months

Phishing campaigns against encrypted messaging apps are set to grow. Between 2027 and 2028, as generative AI is increasingly used to create ever more convincing phishing content, the risk will rise even further.

Still, countermeasures exist, and they're within reach. Signal has said it is working on additional warning mechanisms for situations where the recovery key is requested. Even so, the primary responsibility remains with users and organizations.

So the time to act is now. Reviewing internal policies, training your staff and considering specialized advice are steps that don't require big investments. By contrast, the cost of a security incident, in financial, legal and reputational terms, can be very high.

To learn more about how to integrate security and digital strategy in your SME, the SHM Studio team is available for a consultation. You can also explore our artificial intelligence services, our web development offering, our SEO copywriting work and our campaigns on Google Ads and LinkedIn. Finally, to stay up to date on the latest in digital, we recommend following our blog.