Hundreds of users install WhatsApp clone by government spyware developer
WhatsApp has announced that two hundred users have mistakenly installed a clone of the messenger for iPhone that contained spyware. TechCrunch writes this with reference to the company's official statement.
The Italian spyware developer SIO is accused of creating the fake WhatsApp. Accordingly, users in this region were affected the most.
" Our security team proactively identified around 200 users primarily in Italy who we believe may have downloaded this malicious unofficial client ," WhatsApp said in a statement.
Spokeswoman Marguerite Franklin said the company could not provide information at this time on whether the affected users were civil society activists or journalists.
WhatsApp has logged users out, warned of the security and privacy risks associated with downloading unofficial clients, and provided a link to the official app. In the future, the company plans to send the developer a "legal statement demanding that they stop any harmful activity".
SIO is behind a whole series of Android malware with spyware: in addition to WhatsApp, the developer released clones of customer support tools for mobile operators. The spyware was identified by the name Spyrtacus, which was spotted in the code.
According to TechCrunch, the use of clone software for tracking purposes is a tactic that is often used by Italian authorities. In some cases, they cooperate with mobile operators who send phishing links to their customers on behalf of law enforcement agencies.
SIO develops government spyware through its subsidiary ASIGINT. Like Apple, it did not respond to a request for .
Last year, WhatsApp warned 90 users that they had been targeted by spyware developed by US-Israeli surveillance technology maker Paragon Solutions. The alerts were received by journalists and pro-immigration activists, among others, causing a major scandal across Italy. In response, Paragon terminated its cooperation with local intelligence services.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
