Fake WhatsApp Spyware Alert: Protect Your iPhone and Android

WhatsApp has notified approximately 200 users who were tricked into installing a malicious, fake version of its messaging application. The unofficial client contained spyware designed to compromise user privacy and security, primarily targeting individuals in Italy.

The company identified the threat as a counterfeit version of the app for iPhones. According to an announcement shared with TechCrunch, WhatsApp’s security team proactively detected the affected users and took immediate action by logging them out of their accounts.

The Role of SIO and Spyrtacus

WhatsApp has accused the Italian spyware manufacturer SIO of creating the fake application. SIO operates a subsidiary called Asigint, which advertises surveillance solutions to government organizations, police, and intelligence agencies for monitoring suspects and conducting covert operations.

This is not the first time SIO has been linked to such activities. In December 2025, it was reported that SIO was responsible for a series of malicious Android apps that mimicked WhatsApp and other popular tools, as well as fake customer support applications for cellphone providers.

The spyware used in those previous Android attacks was identified by the name Spyrtacus, a term found within the software’s code. Those apps were believed to have been utilized by a government customer to target victims within Italy.

Impact and Mitigation Efforts

The most recent attack utilized social engineering tactics to deceive users into sideloading the malicious software. While the primary targets were in Italy, reports indicate the threat may have extended to both Android and iPhone users.

In response to the breach, WhatsApp implemented the following measures:

• Logged out the approximately 200 identified users to terminate the spyware’s access.
• Sent notifications alerting these users to the privacy and security risks associated with unofficial clients.
• Instructed affected users to remove the fake application and install the official version from authorized app stores.

When asked if the targets included journalists or members of civil society, WhatsApp spokesperson Margarita Franklin stated that the company cannot share more information about the notified users, emphasizing that the priority was protecting those tricked into downloading the fake iOS app.

The Broader Surveillance Landscape

The activity of SIO is part of a larger trend of surveillance tool production in Italy. The country has become a hub for spyware firms, with other notable companies including Cy4Gate, eSurv, GR Sistemi, Negg, Raxir, and RCS Lab.

WhatsApp has previously dealt with similar threats. In early 2025, the platform alerted around 90 users that they had been targeted by Graphite, a type of spyware developed by Paragon Solutions.

To address the current threat from SIO, WhatsApp stated it plans to send a formal legal demand to stop any such malicious activity to this spyware firm.

Security experts continue to warn users against sideloading apps or downloading unofficial clients, as these methods bypass the security screenings provided by official platforms like the Apple App Store and Google Play Store, leaving devices vulnerable to data theft and remote monitoring.