Malicious App Detected
WhatsApp recently identified and alerted around 200 individuals, primarily located in Italy, who had inadvertently downloaded a deceptive imitation of
the popular messaging application. This counterfeit app was engineered by an Italian entity specializing in government spyware, with the intent to infiltrate users' devices and monitor their communications. The company's security teams were instrumental in proactively discovering this threat, which was disguised as the legitimate WhatsApp service for iOS devices. Upon detection, WhatsApp took immediate steps to secure these affected accounts by logging users out, issuing crucial warnings about the inherent risks associated with unofficial application clients, and strongly advising the removal of the malicious software in favor of the genuine application.
Spyware Firm Identified
The entity responsible for the creation of this deceitful application has been identified as an Italian firm known for its involvement in developing government surveillance tools. This particular spyware, potentially identified within its code as 'Spyrtacus,' had previously been linked to a series of malicious Android applications. These included fake versions of popular services like WhatsApp, as well as simulated customer support applications designed to mislead users of mobile carriers. This past activity demonstrates a pattern of deceptive practices aimed at deploying surveillance technology through seemingly harmless software. The company has indicated its intention to pursue legal avenues, planning to issue formal demands to cease these harmful activities directed at the spyware firm.
Broader Surveillance Tactics
The use of counterfeit applications as a method to target individuals for surveillance is a recognized tactic, particularly in certain regions where authorities may collaborate with mobile providers. This collaboration can involve the distribution of phishing links to customers, ostensibly on behalf of law enforcement agencies, which can then lead to the installation of spyware. This incident with WhatsApp echoes similar past events where users were targeted with sophisticated spyware. For example, approximately a year prior, WhatsApp notified around 90 users, including journalists and activists, about being targeted by spyware from a different surveillance technology maker. That situation led to significant repercussions, including the involved company severing ties with Italian intelligence agencies that were its clients, highlighting the sensitive nature and broad implications of such surveillance operations.
