WhatsApp alerts users targeted by fake spyware app

WhatsApp has proactively notified around 200 users who were tricked into installing a malicious fake version of its chat app. The company’s security team proactively identified these users, who are primarily in Italy, and believes they may have downloaded this malicious unofficial client. In response, WhatsApp has logged the affected users out, alerted them to the privacy and security risks associated with downloading fake unofficial clients, and encouraged them to remove the software. “Our priority has been protecting the users who may have been tricked into downloading this fake iOS app,” said Margarita Franklin, a WhatsApp spokesperson. Italian newspaper La Repubblica and news agency ANSA first reported the news of the incident, which involved a fake version of the messaging app designed for iPhones.

WhatsApp has accused SIO, an Italian spyware maker, of creating the fake version of its messaging app. SIO develops government spyware through its subsidiary ASIGINT. According to TechCrunch, SIO was previously behind a series of malicious Android apps that contained its spyware, which was identified in code under the name Spyrtacus. These previous malicious apps included fake versions of WhatsApp as well as fake customer support tools for cellphone providers. Using fake apps against targets of surveillance is a well-established tactic used by authorities in Italy, who often receive collaboration from cellphone providers to send phishing links to customers on behalf of law enforcement. Neither Apple nor SIO responded to requests for comment regarding the incident.

To address the activity, WhatsApp plans to send a formal legal demand to stop any such malicious activity to this spyware firm. This legal push and user notification campaign follows a similar incident last year, when WhatsApp alerted around 90 users that they had been targeted with spyware. That previous incident involved spyware made by the U.S.-Israeli surveillance tech maker Paragon Solutions. In response to those alerts, Paragon cut ties with Italy’s spy agencies, which were its customers.

Why it matters

WhatsApp is taking action against a spyware maker by notifying users who were tricked into installing a malicious version of its app, marking a continued effort to combat surveillance tools targeting its users.