WhatsApp has notified approximately 200 users who were tricked into installing a malicious fake version of its iOS app containing spyware. The company identified the fake app as being created by Italian spyware maker SIO, according to a statement shared with TechCrunch.
“Our security team proactively identified around 200 users, mainly in Italy, who may have downloaded this malicious unofficial client,” WhatsApp said. “We have logged them out, alerted them to the privacy and security risks, and encouraged them to remove it and download the official app.”
A WhatsApp spokesperson, Margarita Franklin, said that the company’s No. 1 priority was to protect affected users. She did not provide details about the users, including whether they were journalists or civics. WhatsApp also intends to send a formal legal request to SIO to cease its malicious action.
The news was first reported by Italian media La Repubblica and ANSA. Last year, it was reported that SIO had created many malicious Android apps using its spyware, including fake versions of WhatsApp and counterfeit customer support tools. Spyware, known as Spyrtacus, was found in the apps’ code.
Using fake apps for surveillance is a known tactic in Italy. Authorities often collaborate with cellphone providers to send phishing links to potential targets. SIO develops government spyware through its subsidiary ASIGINT. Apple and SIO have not commented on the matter.
It comes after another similar incident last year, in which WhatsApp warned about 90 users they were targeted with spyware created by the U.S.-Israeli company Paragon Solutions. Its targets included journalists and pro-immigration activists, igniting a scandal in Italy. In turn, Paragon terminated its contracts with Italian spy agencies.
WhatsApp’s proactive notifications and legal action highlight ongoing risks from fake apps used to deploy spyware, underscoring the importance of downloading only official versions of messaging platforms.
