Signal Social Engineering Campaign: Detection and Response for Backup Key Theft

---
title: Potential Signal Phishing Keywords - Proxy/Email Logs
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential Signal-related phishing by identifying keywords like "recovery key" or "support" in URLs or email bodies often used in smishing campaigns.
references:
  - https://securityaffairs.com/192899/security/signal-phishing-campaign-targets-journalists-and-activists-to-steal-backup-recovery-keys.html
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.social_engineering
  - attack.credential_access
logsource:
  category: proxy
  product: any
detection:
  selection:
    cs-method|contains:
      - 'GET'
      - 'POST'
    cs-uri-query|contains|all:
      - 'signal'
      - 'support'
    cs-uri-query|contains:
      - 'recovery'
      - 'key'
      - 'verify'
  condition: selection
falsepositives:
  - Legitimate navigation to Signal support documentation (support.signal.org)
level: medium
---
title: Signal Desktop Process Anomalous Network Connection
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects Signal Desktop (Signal.exe) initiating connections to non-Signal domains, which may indicate a user clicked a phishing link from a targeted SMS or is communicating with a C2 domain.
references:
  - https://securityaffairs.com/192899/security/signal-phishing-campaign-targets-journalists-and-activists-to-steal-backup-recovery-keys.html
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\Signal.exe'
    DestinationHostname|contains:
      - 'signal.org'
  filter_main_legit:
    DestinationHostname|endswith:
      - '.signal.org'
  condition: selection and not filter_main_legit
falsepositives:
  - Link previews in chats (may generate connections to non-signal.org domains)
level: low


**KQL (Microsoft Sentinel / Defender)**

// Hunt for Signal Phishing Keywords in Proxy Logs
let Keywords = dynamic(["recovery key", "Signal Support", "verify account", "backup key"]);
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "Signal.exe" 
// Note: If SMS clicked on mobile, look for mobile browsers in DeviceEvents if available, or firewall logs
| where RemoteUrl has_any (Keywords) 
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| extend URLProps = pack_all()
| summarize count() by DeviceName, RemoteUrl


**Velociraptor VQL**

-- Hunt for Signal Backup Files to Assess Impact
SELECT FullPath, Size, Mtime, Atime, Mode
FROM glob(globs=["/Users/*/Library/Application Support/Signal/*.db", 
                 "%APPDATA%\Signal\*.sqlite", 
                 "%APPDATA%\Signal\*.sql",
                 "C:\Users\*\AppData\Roaming\Signal\*.db"])
WHERE Mode.ModeString =~ "r"
-- Check for backup.zip or encrypted backup artifacts often named backup.signal
OR FullPath =~ "backup"


**Remediation Script (PowerShell)**

<#
.SYNOPSIS
    Audit Script: Detect Signal Installation and Backup Files
.DESCRIPTION
    Locates Signal executable and identifies backup files for risk assessment.
    Run this to determine if the targeted user has local backups that could be decrypted by the stolen key.
#>

$ErrorActionPreference = "SilentlyContinue"

# Check for Signal Desktop Installation
$SignalPath = "$env:LOCALAPPDATA\Programs\signal-desktop\Signal.exe"
$SignalDataPath = "$env:APPDATA\Signal"

Write-Host "[+] Checking for Signal Desktop Installation..."
if (Test-Path $SignalPath) {
    Write-Host "[!] Signal Desktop Installed: $SignalPath" -ForegroundColor Yellow
    
    if (Test-Path $SignalDataPath) {
        Write-Host "[+] Scanning for potential backup/database files in $SignalDataPath..."
        $Files = Get-ChildItem -Path $SignalDataPath -Recurse -File | 
                 Where-Object { $_.Extension -match '\.(db|sql|log|)' -or $_.Name -match 'backup' }
                 
        if ($Files) {
            $Files | ForEach-Object {
                Write-Host "    - Found: $($_.FullName) (Modified: $($_.LastWriteTime))" -ForegroundColor Cyan
            }
        } else {
            Write-Host "    [+] No standard backup files found in local profile."
        }
    }
} else {
    Write-Host "[-] Signal Desktop not found on this endpoint."
}

# Note: If a compromise is confirmed, the remediation is manual:
# 1. Uninstall Signal.
# 2. Delete %APPDATA%\Signal.
# 3. Reinstall Signal and register with a new phone number (or same number after reset).
# 4. Generate NEW safety numbers with all contacts.