Messaging giant WhatsApp has alerted hundreds of users after discovering a malicious fake app that masqueraded as a legitimate service but was actually sophisticated spyware, reportedly linked to government-backed surveillance operations targeting specific individuals.
TL;DR
- WhatsApp said around 200 users were notified after downloading a fake version of the app containing spyware
- The campaign primarily affected users in Italy and was tied to Italian surveillance vendor SIO
- Meta said the attack relied on social engineering and unofficial app distribution
- WhatsApp plans legal action and urged affected users to remove the fake client and install the official app
What Happened?
WhatsApp has revealed that it recently notified around 200 users who may have been targeted by a fake application that installed surveillance-grade spyware on their devices. The company said most of the affected users were primarily in Italy.
According to statements shared with media outlets, the malicious app was designed to look like an unofficial WhatsApp client for iPhones. Victims were reportedly tricked into downloading it outside official app distribution channels, allowing attackers to place spyware directly on their devices.
Reports linked the operation to Italian spyware maker SIO and its subsidiary ASIGINT, which markets surveillance capabilities to government and law enforcement agencies. WhatsApp said it had proactively identified the users, logged them out, and warned them about the privacy and security risks tied to downloading fake clients.
What Did WhatsApp Say?
WhatsApp said its security team identified the impacted users and moved quickly to contain the threat. The company also said it encouraged affected users to delete the malicious app and reinstall the official version of WhatsApp.
A WhatsApp spokesperson reported that the company’s immediate priority was protecting users who may have been tricked into installing the fake iOS app. The company also said it plans to send a formal legal demand to stop the malicious activity attributed to the spyware firm.
The disclosure marks another spyware-related incident involving WhatsApp users in Italy. This is the second time in about 15 months that Meta has publicly disrupted a spyware campaign linked to Italy.
How Did The Attack Work?
This campaign appears to have relied more on deception than on a direct exploit in WhatsApp itself. By using social engineering, attackers convinced a limited number of targets to install a counterfeit version of the app through unofficial means.
That matters because sideloaded or unofficial mobile apps can bypass some of the trust signals users normally rely on through official app stores. Once installed, spyware can potentially access sensitive communications, device activity, and personal data depending on the permissions obtained and the device setup.
A malicious client was used in a targeted operation, not a broad mass attack. That fits the profile of commercial spyware campaigns often aimed at specific people of interest rather than the general public.
Why This Matters
The incident adds to growing concerns around the global spyware market, where surveillance tools built for governments and law enforcement can also end up being used against journalists, activists, and civil society groups.
Even when companies position these tools as lawful interception technology, their deployment often sparks scrutiny over oversight and abuse.
For Meta and WhatsApp, the case also underscores a broader security challenge. End-to-end encryption can protect message content in transit, but if an attacker compromises the device itself through spyware, the privacy of users can still be at risk.
The latest disclosure also shines a spotlight on the tactics used by spyware operators, especially fake apps and social engineering. It is a reminder that mobile threats increasingly depend on user manipulation, not just software vulnerabilities.
Topics for more insights:
What Should Users Do?
WhatsApp urged users to avoid downloading unofficial versions of its app and to stick to trusted app sources. It also recommended removing suspicious clients immediately and installing the official app.
Users should also review device management settings, keep operating systems updated, and treat unexpected installation prompts or links with caution. For organizations, the incident is another signal that mobile security awareness and app installation controls remain essential.
Join The Discussion