Cybersecuritydive

CISA Warns of Spyware Targeting Signal and WhatsApp Accounts

First seen 25 Nov 2025, 12:28 UTC • •33.3

Article Content

1 / 13

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

CISA has issued a warning regarding state-backed and mercenary threat actors using commercial spyware to compromise Signal and WhatsApp accounts. These groups employ phishing, fake QR codes, malicious app impersonation, and zero-click exploits to access devices of high-value users. The agency advises users to take protective measures against these sophisticated attacks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 241d ago How this analysis works

Threat Graph

10 entities, 14 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

Sandworm
Turla

Technique (3)

Malware
Phishing
T1566 - Phishing

Organization (1)

Signal

Malware (1)

Landfall

Affected Platform (3)

Android
Telegram
WhatsApp

Relationships

Sandworm uses Landfall
Turla uses Landfall
Sandworm uses Malware
Sandworm uses Phishing
Sandworm uses T1566 - Phishing
Turla uses Malware
Turla uses Phishing
Turla uses T1566 - Phishing
Sandworm targets Signal
Turla targets Signal
Landfall targets Signal
Sandworm related to Android
Sandworm related to Telegram
Sandworm related to WhatsApp

Following this threat?

Track Sandworm, Landfall and Signal in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

CISA Warns of Spyware Targeting Signal and WhatsApp Accounts

Article Content

More articles in this cluster (12)

Threat Graph

Following this threat?

Extracted Entities (13)

APT Groups (2)

Attack Types (2)

Countries (2)

Industries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (3)

Companies (1)