The information provided below is an update to a Public Service Announcement released in March 2026.

RIS actors are still impersonating CMA support accounts in phishing messages, but their tactics have shifted toward stealing victims' Backup Recovery Keys. If a user shares this key - along with verification codes or PINs - the attackers can access past CMA messages, private/group chats, and even take over the account.

Because a Backup Recovery Key stays valid even after creating a new account with the same phone number, attackers could later compromise the new account as well. The only mitigation is generating a new Backup Recovery Key in Settings, which invalidates the old one for future backups, though it cannot undo any data already stolen.

CISA and FBI Update PSA on Russian Intelligence Services Targeting Commercial Messaging Apps

06/26/2026 2:00 PM EDT

Today, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued Russian Intelligence Services Continue to Target Commercial Messaging Applications, an update to the March 2026 public service announcement (PSA) warning of Russian Intelligence Services (RIS) cyber threat actors targeting individuals on commercial messaging applications (CMAs) in ongoing phishing campaigns. High value targets include current and former government officials, military personnel, political figures and journalists.

The updated PSA shares recent tactics, recommended mitigations, and sample phishing messages. CISA and the FBI urge CMA users to remain vigilant, review the security reminders, and follow recommended cyber hygiene practices.

• Phishing Guidance: Stopping the Attack Cycle at Phase One
• Mobile Communications Best Practice Guidance