WhatsApp says it has notified around 200 users who were tricked into installing a malicious fake version of the chat app that contained government spyware.\u00a0<\/p>\n
WhatsApp accused Italian spyware maker SIO of creating a fake version of its messaging app for iPhones, according to an announcement the company shared with TechCrunch.\u00a0\u00a0<\/p>\n
\u201cOur security team proactively identified around 200 users primarily in Italy who we believe may have downloaded this malicious unofficial client,\u201d WhatsApp said in its statement. \u201cWe have logged them out, alerted to the risks to their privacy and security that come with downloading fake unofficial clients, and encouraged them to remove it and download the official WhatsApp app.\u201d<\/p>\n
WhatsApp spokesperson Margarita Franklin told TechCrunch that, at this point, the company cannot share more information about the users it notified, such as whether they were journalists or members of civil society.\u00a0<\/p>\n
\u201cOur priority has been protecting the users who may have been tricked into downloading this fake iOS app,\u201d said Franklin.\u00a0<\/p>\n
In its announcement, WhatsApp also said it plans to \u201csend a formal legal demand to stop any such malicious activity to this spyware firm.\u201d<\/p>\n Italian newspaper La Repubblica<\/a> and news agency ANSA<\/a> first reported the news.<\/p>\n Last year, TechCrunch revealed that SIO was behind a series of malicious Android apps<\/a> that contained its spyware, including fake versions of WhatsApp, as well as fake customer support tools for cellphone providers. SIO\u2019s spyware was identified with the name Spyrtacus, a word that appeared in the spyware\u2019s code.<\/p>\n \t\t\tDo you have more information about SIO, or other government spyware makers? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or by email<\/a>.<\/a> \t\t<\/div>\n Using fake apps against targets of surveillance is a well-established tactic used by authorities in Italy<\/a>, who often get collaboration from cellphone providers, who send phishing links to their customers on behalf of law enforcement.<\/p>\n SIO develops government spyware<\/a> through its subsidiary<\/a> ASIGINT.\u00a0<\/p>\n Apple and SIO did not respond to a request for comment.\u00a0<\/p>\n WhatsApp\u2019s latest announcement comes a year after the company alerted around 90 users<\/a> that they had been targeted with spyware made by the U.S.-Israeli surveillance tech maker Paragon Solutions<\/a>. WhatsApp sent those notifications to journalists<\/a> and pro-immigration<\/a> activists<\/a>, among others, sparking a wide-ranging scandal across Italy.\u00a0<\/p>\n In response, Paragon cut ties<\/a> with Italy\u2019s spy agencies, which were its customers<\/a>.<\/p>\n<\/div>\n![\"\"](\"https:\/\/techcrunch.com\/wp-content\/uploads\/2026\/04\/WhatsApp_spyware_Notification_English.jpeg?w=313\")
Contact Us<\/h4>\n