WhatsApp Warns 200 Users About Fake iPhone App It Links to SIO Spyware
Summary
WhatsApp says about 200 users, mostly in Italy, installed a fake iPhone app infected with spyware it attributes to SIO subsidiary ASIGINT. The company logged out affected users and urged them to install the official app.
Key points
- WhatsApp says about 200 users, mostly in Italy, were tricked into installing a fake iPhone WhatsApp client infected with spyware.
- WhatsApp attributes the malicious app to SIO subsidiary ASIGINT; the company says its security team proactively identified it.
- WhatsApp said this was not a platform vulnerability and that end-to-end encryption remains intact for users of its official apps.
- WhatsApp logged out affected users, warned them about the risks, and urged them to remove the fake app and install the official one.
- WhatsApp described the social engineering as highly targeted, but did not identify the victims.
Article Details
- Victim Organization
- WhatsApp users
- Incident Type
- Social engineering to distribute a fake iPhone WhatsApp client infected with spyware
- Affected Records
- About 200 users were alerted and logged out; no affected data-record count was reported.
- Operational Impact
- WhatsApp logged out affected users and warned them to remove the unofficial client and install the official app. WhatsApp said the incident was not a vulnerability in its platform and that end-to-end encryption remained intact for users of its official apps.
- Claim Status
- alleged
Threat Actors
ASIGINTWhatsApp blamed ASIGINT, identified as SIO’s subsidiary, for creating the malicious client.NSO GroupThe article reports that WhatsApp sued NSO Group over alleged use of its platform to target users with Pegasus, and that a federal judge later found NSO liable.Paragon SolutionsThe article says WhatsApp had previously notified users targeted with Paragon Solutions’ Graphite spyware.SIOWhatsApp alleged that SIO designed the fake iPhone WhatsApp client infected with spyware.
Malware
Graphitethis was not a WhatsApp vulnerability, and linked the incident to prior spyware campaigns such as Graphite (Paragon Solutions) and Pegasus (NSO Group), while Apple and SIO did not immediately comment.Pegasusand linked the incident to prior spyware campaigns such as Graphite (Paragon Solutions) and Pegasus (NSO Group), while Apple and SIO did not immediately comment.
Vendors
NSO Groupand linked the incident to prior spyware campaigns such as Graphite (Paragon Solutions) and Pegasus (NSO Group), while Apple and SIO did not immediately comment.Paragon Solutionsnot a WhatsApp vulnerability, and linked the incident to prior spyware campaigns such as Graphite (Paragon Solutions) and Pegasus (NSO Group), while Apple and SIO did not immediately comment.SIOWhatsApp said it alerted about 200 users—mostly in Italy—that they were tricked into installing a fake iPhone WhatsApp client infected with spyware the company blames on SIO’s ASIGINT subsidiary.
Products
iPhoneWhatsApp said it alerted about 200 users—mostly in Italy—that they were tricked into installing a fake iPhone WhatsApp client infected with spyware the company blames on SIO’s ASIGINT subsidiary.WhatsAppWhatsApp said it alerted about 200 users—mostly in Italy—that they were tricked into installing a fake iPhone WhatsApp client infected with spyware the company blames on SIO’s ASIGINT subsidiary.