Loading story…
WhatsApp said it notified about 200 users, mostly in Italy, after they were tricked into installing an unofficial iPhone version of WhatsApp embedded with spyware. The company said the incident did not stem from a vulnerability in WhatsApp itself, but from highly targeted social engineering that led victims to download the malicious client. WhatsApp logged affected users out, warned them of the privacy and security risks, and urged them to delete the fake app and reinstall the official version.
The company attributed the operation to ASIGINT, a subsidiary of Italian spyware maker SIO, and said it plans to send SIO a formal legal demand to halt the activity. The campaign adds to scrutiny of Italian surveillance vendors, following earlier reporting on SIO-linked Android spyware, including fake WhatsApp apps associated with Spyrtacus, and a separate WhatsApp notification campaign tied to Paragon Solutions and its Graphite spyware that reportedly targeted journalists and pro-immigration activists in Italy.
Get the infrastructure and lures behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Alongside its disclosure, WhatsApp said it planned to send SIO a formal legal demand ordering the company to stop the malicious activity. The move signaled a potential escalation beyond user notifications into legal action.
WhatsApp said it notified about 200 affected users, logged them out of the malicious client, warned them of privacy and security risks, and urged them to remove the fake app and install the official version. Most of the impacted users were reported to be in Italy.
WhatsApp said the spyware operation behind the fake iPhone app was carried out by ASIGINT, a subsidiary of Italian spyware maker SIO. The company publicly connected the campaign to the Italian surveillance vendor ecosystem.
Around 200 users, primarily in Italy, were socially engineered into installing an unofficial iPhone version of WhatsApp that contained government spyware. WhatsApp said the malicious app was not the result of a vulnerability in its service.
Before this newly disclosed incident, WhatsApp had warned roughly 90 users, including journalists and pro-immigration activists, about targeting linked to Paragon Solutions' Graphite spyware in Italy. The case formed part of a broader spyware scandal involving Italian surveillance vendors.
Prior reporting identified Italian spyware maker SIO as distributing spyware through malicious Android applications, including fake WhatsApp versions. The spyware associated with these apps was identified as Spyrtacus.
In a December 2024 ruling referenced in the coverage, a court found NSO Group liable for targeting WhatsApp users with Pegasus spyware. The decision was part of WhatsApp's ongoing legal battle against NSO.
Kaspersky previously reported that operators distributed the Spyrtacus spyware through Google Play in 2018. By 2019, the campaign had shifted to fake websites impersonating Italian internet providers to deliver the malware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
9 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourceteiss.co.uk
Open sourcetechcrunch.com
Open sourcerepubblica.it
Open sourcetherecord.media
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WhatsApp said it disrupted a **zero-click spyware campaign** that targeted about 90 users, including journalists and civil society members across more than two dozen countries, and linked the activity to Israeli spyware maker **Paragon**. The company said attackers used malicious PDF files sent through WhatsApp groups to compromise devices, patched the attack path, notified affected users, and sent Paragon a cease-and-desist letter. Researchers at Citizen Lab said they had also observed Paragon using the same vector, marking one of the first public cases tying the company to alleged surveillance of journalists and activists. The disclosure escalated into a political dispute in Italy after journalist **Francesco Cancellato** was identified among the targets. Paragon said it terminated contracts with Italian government customers after Rome refused its help in determining whether its **Graphite** spyware had been used unlawfully, while Italian officials said broader access to spyware logs would have exposed sensitive intelligence information and described the suspension as mutual. Italy’s parliamentary committee **COPASIR** said there was no evidence that intelligence agencies targeted Cancellato, though it confirmed the agencies were Paragon customers and found that some other individuals had been lawfully surveilled in investigations, intensifying scrutiny of Paragon’s claims that it operates as a more responsible spyware vendor.
Jun 29, 2026
Italian prosecutors are investigating a spyware scandal after **WhatsApp** and **Apple** alerted journalists, activists, and NGO workers that they had been targeted with mercenary spyware linked to **Paragon Solutions’ Graphite** platform. The campaign reportedly affected about 90 people worldwide, and public disclosures in Italy included journalist **Francesco Cancellato**, Fanpage journalist **Ciro Pellegrino**, and Mediterranea Saving Humans figures **Luca Casarini** and **Beppe Caccia**. Researchers at **Citizen Lab** later confirmed infections of Pellegrino and another European journalist, tying one case to a sophisticated zero-click **iMessage** exploit that Apple said was mitigated in `iOS 18.3.1`. The case has intensified scrutiny of Italy’s intelligence services after a parliamentary committee said agencies **AISI** and **AISE** were Paragon customers, even as the government denied targeting legally protected subjects such as journalists. Paragon said it had offered help investigating the alleged surveillance and later cut ties with Italy, but prosecutors in Rome and Naples reportedly have not received the company’s cooperation through formal channels, raising questions about accountability and Israeli assistance in spyware investigations. The dispute echoes earlier battles over Israeli spyware vendors, including **NSO Group’s Pegasus**, which was previously used in WhatsApp-based attacks and became the subject of major litigation and international scrutiny.
Jun 29, 2026
Researchers reported that a malicious modified version of WhatsApp was being distributed through seemingly legitimate Android applications, allowing attackers to compromise users who installed the software outside official channels. The campaign relied on repackaged apps that appeared benign but delivered a trojanized WhatsApp mod, expanding the reach of malware through trusted-looking distribution paths rather than direct phishing alone. The activity highlights the risk posed by unofficial messaging clients and third-party app ecosystems, where attackers can hide malware inside popular software variants to steal data, abuse device access, or deploy additional payloads. The incident underscores that users and organizations should restrict installations to official app stores and vetted software sources, especially for high-use communications platforms such as **WhatsApp**.
Jul 12, 2026