WhatsApp Alerts 200 Users to Spyware in Fake iOS App, Blames Italian Firm SIO

WhatsApp has informed approximately 200 users, primarily located in Italy, that they had installed a malicious, unauthorized version of its chat application containing spyware. The company attributed the creation of this fake iOS application to Italian spyware maker SIO and has initiated steps to address the incident.

WhatsApp's security team identified approximately 200 affected users, logging them out of the service and advising them to remove the malicious application due to privacy and security risks.

Incident Details

WhatsApp’s security team identified the affected users, who were subsequently logged out of the service. The company alerted these users to privacy and security risks associated with unofficial client downloads and advised them to remove the unauthorized application and install the official WhatsApp app. Reports of this incident were first published by Italian news outlets La Repubblica and ANSA.

WhatsApp's Response and Legal Action

A WhatsApp spokesperson indicated that user protection is the primary concern regarding this incident. The company declined to disclose further details about the notified users, such as their professions or identities. WhatsApp stated its intention to send a formal legal demand to SIO to cease any such activities.

Attribution and Background on SIO

WhatsApp attributed the fake iOS application containing spyware to Italian firm SIO. SIO was previously identified by TechCrunch and other reports as the creator of malicious Android applications containing spyware, known as Spyrtacus. These Android applications included fake WhatsApp versions and customer support tools for cellular providers. SIO develops government spyware through its subsidiary, ASIGINT. When contacted, Apple and SIO did not provide comments regarding the incident.

Context of Surveillance Practices

The use of fake applications for surveillance targets is a documented tactic employed by authorities in Italy. These operations sometimes involve collaboration with cellular providers to distribute phishing links, potentially on behalf of law enforcement.

Previous Incidents

This announcement follows a prior incident approximately a year earlier, when WhatsApp notified about 90 users of being targeted with spyware. That previous event involved spyware from Paragon Solutions, a U.S.-Israeli surveillance technology firm. The affected individuals in that incident reportedly included journalists and pro-immigration activists in Italy. Following that notification, Paragon Solutions discontinued its contracts with Italian intelligence agencies, which had been its clients.