A new cybersecurity alert has once again put WhatsApp at the center of the debate after the discovery of a fraudulent version of the app containing spyware. Meta, the messaging service's parent company, has notified approximately 200 people that they may have unknowingly installed an unofficial client designed to spy on their devices.
Most of the affected users are in Italy, one of the European countries where the use of digital surveillance tools has been most discussed . Although the attack has primarily targeted iPhones, several reports indicate that Android devices were also involved, in both cases through an app that mimicked the look and function of WhatsApp.
A fake WhatsApp app containing spyware targeted approximately 200 users
As confirmed by the company itself, its internal security team proactively identified a pattern of anomalous activity linked to an unofficial WhatsApp client. Based on this analysis, Meta concluded that approximately 200 users had been tricked into installing a modified version of the app.
This malicious software was presented as a legitimate update or variant of WhatsApp , but in reality it incorporated spyware capable of accessing sensitive data stored on the mobile phone: conversations, contacts, files and other private content that are especially valuable for selective surveillance.
Meta insists that the incident is not due to a direct vulnerability in the official application , but rather to a social engineering attack . In other words, the attackers did not exploit a technical flaw in WhatsApp, but instead convinced victims to download a fake app that appeared authentic.
Once the problem was confirmed, the company closed the sessions of the potentially compromised profiles, sent a prominent notification within the platform itself , and recommended uninstalling any unofficial clients and installing only the version available in the official stores.
In those warnings, WhatsApp reminded users that downloading apps from unverified channels can open the door to almost total control of the device , beyond the messaging service itself, and that using modified or pirated versions significantly increases the risk of espionage.
SIO and ASIGINT, the Italian spyware manufacturer in the crosshairs
Meta has directly pointed to SIO, an Italian manufacturer specializing in government surveillance software , as responsible for developing this fraudulent app. The company operates through its subsidiary ASIGINT, which focuses on intelligence and surveillance products for state agencies.
Previous investigations, cited by media outlets such as TechCrunch and La Repubblica, had already linked SIO to Android malware campaigns . On those occasions, seemingly harmless applications were detected, including fake versions of WhatsApp and tools supposedly associated with mobile carrier customer service.
In that context, spyware dubbed Spyrtacus, a name found within the malicious code itself , came to light. It was allegedly used in operations targeting specific individuals. The emergence of an iOS variant now fits into a broader strategy aimed at covering both the Apple and Google ecosystems.
In this latest case, the fraudulent app completely mimicked the design of WhatsApp for iPhone , to the point of being virtually indistinguishable to the average user. Furthermore, its distribution was not carried out through the App Store or Google Play, but rather through alternative channels and links shared outside of the usual distribution channels.
Neither SIO nor Apple has yet offered a public explanation regarding the accusation . Meanwhile, Meta has announced it will file a formal lawsuit to curb activities related to this spyware and send a clear message to other vendors using similar tactics.
Italy, European epicenter of the controversy over the use of spyware
The incident did not occur in a vacuum: Italy has already been plagued by several scandals related to the use of intrusive surveillance tools . Various press reports and reports from specialized organizations indicate that installing fake apps or sending phishing links are among the tactics used in certain investigations.
In some documented cases, experts and journalists have reported that mobile phone operators have collaborated by sending malicious SMS messages or links at the request of law enforcement agencies, raising significant questions about judicial oversight and the legal limits of such operations.
WhatsApp's new warning comes just a year after the platform alerted some 90 users that they had been attacked with spyware from Paragon Solutions , an American-Israeli surveillance technology company. At that time, many of the targets were journalists and pro-immigration activists.
That episode sparked an intense political debate in Italy and the rest of Europe, forced Paragon to sever its ties with the Italian intelligence services , and highlighted the vulnerability of particularly sensitive groups to digital surveillance.
With this new case, the country is once again under scrutiny, as three sensitive elements converge: privately sourced spyware tools, their potential use for research purposes, and a mass messaging platform as an entry point . All of this has reignited discussions about the controls that should be applied to the spyware industry.
WhatsApp's response: session closures and legal action
The company insists that its immediate priority has been protecting the notified users . Upon detecting the suspicious behavior of this unofficial client, the affected sessions were remotely closed to cut off, as much as possible, the spyware's access to the device's data.
In the notifications sent, WhatsApp explained that it had detected the use of an unofficial version of the app and strongly recommended uninstalling it and downloading the legitimate application from the official store . This message was displayed prominently so that users would take immediate action.
Company spokesperson Margarita Franklin stated that, at this time, they cannot reveal the specific profiles of those affected . It has not been confirmed whether the 200 notified users include journalists, human rights defenders, or other groups considered high-risk.
In addition to technical measures, Meta is preparing a legal challenge against SIO and its corporate network , with the intention of halting new campaigns supported by apps that impersonate WhatsApp. The company emphasizes that these actions are part of a broader strategy to put pressure on the spyware industry in court.
The company also emphasizes that the incident does not involve a breach in WhatsApp's infrastructure or a failure in its encryption systems . The problem lies in the use of modified clients that bypass the controls of official app stores and take advantage of the trust generated by a widely known brand.
Privacy risks in Europe and advice for users
Beyond this specific case, this episode once again demonstrates that messaging apps have become a prime target for digital espionage operations . The vast amount of information they contain—from personal chats to location data—makes them a highly attractive avenue for those seeking to monitor specific individuals.
Cybersecurity organizations remind users that when spyware is successfully installed, simply logging out or deleting the visible app isn't always enough . The malicious code may have obtained persistent permissions or left components running in the background that continue to collect data, so in some cases, restoring the device to factory settings is even recommended.
To reduce the risk of falling for these types of scams, experts recommend a series of basic but effective measures: download apps only from the App Store or Google Play , be wary of links that promise "special" versions of popular services, and carefully check the developer's name before installing any software.
It's also crucial to keep your operating system and apps up to date , as new versions often fix vulnerabilities that could be exploited by attackers. Reviewing the permissions granted to each application and uninstalling those that aren't essential helps to limit the attack surface.
On the regulatory front, the incident fuels the European debate on how to control the export, use, and monitoring of spyware tools . While institutions discuss potentially stricter regulatory frameworks, major technology platforms are beginning to combine technical defenses, mass warnings, and lawsuits to try to curb the commercial espionage business.
The entire incident involving this fake version of WhatsApp, attributed to the Italian company SIO, demonstrates the extent to which user trust can be exploited by apps that appear legitimate. For those who use messaging services in Spain and the rest of Europe, the underlying message is clear: exercise extreme caution with unofficial clients and pay attention to any security warnings issued by the providers themselves.
