Signal users targeted in backup-stealing phishing attacks
2026-05-30T20:51:55Z•26dddf2d9eace2df89da6b82d0fc17eb3f89a92f98f80a57ec925db47af62a5c
adobe-abusebackup-theftcertificate-fraudchromeclickfix-campaigncode-signing-fraudcredential-theftdata-breachdeno-ratexploited-vulnerabilitiesfake-download-sitemalware-distributionmfa-bypassmicrosoft-defenderphishingphishing-kitsecure-bootweb-compromise
What happened
Multiple active threats and widespread incidents reported by Malwarebytes Labs in May 2026: criminals are phishing Signal users to steal backup recovery keys (full message archive access) and using new phishing kits (Kali365) to bypass MFA and steal Microsoft logins. Fake download sites and repositories (GitHub/SourceForge) distribute multi-platform malware including a Deno RAT, while a large ClickFix campaign hijacked 700+ websites to push malicious Cloudflare verification pages. Code-signing abuse (Fox Tempest) and certificate fraud are being used to evade detections. Separately, high-impact
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- malwarebytes_labs
- Record identifier
- 26dddf2d9eace2df89da6b82d0fc17eb3f89a92f98f80a57ec925db47af62a5c
- Enrichment time
- 2026-05-30T20:51:55Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.