{"id":471,"date":"2026-04-02T10:30:52","date_gmt":"2026-04-02T10:30:52","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=471"},"modified":"2026-04-02T10:30:52","modified_gmt":"2026-04-02T10:30:52","slug":"whatsapp-alerts-200-users-after-fake-ios-app-installed-spyware-italian-firm-faces-action","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=471","title":{"rendered":"WhatsApp Alerts 200 Users After Fake iOS App Installed Spyware; Italian Firm Faces Action"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Apr 02, 2026<\/span><\/span>Surveillance \/ Mobile Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Meta-owned messaging platform WhatsApp said it alerted about 200 users who were tricked into installing a bogus version of its iOS app that was infected with\u00a0spyware.<\/p>\n

According to reports from Italian\u00a0newspaper La Repubblica<\/a> and news\u00a0agency ANSA<\/a>, the vast majority of the targets are located in Italy. It’s assessed that the threat actors behind the activity used social engineering tactics to get users to install malicious software that mimicked\u00a0WhatsApp.<\/p>\n

All the affected users have been logged out and have been recommended to uninstall the malware-laced apps and download the official WhatsApp app. WhatsApp did not reveal who was targeted in these\u00a0attacks.<\/p>\n

The tech giant said it’s also taking action against Asigint, an Italian subsidiary of spyware company SIO, for allegedly creating a counterfeit version of\u00a0WhatsApp.\u00a0<\/p>\n

On its website, the company advertises solutions to law enforcement agencies, government organizations, and police and intelligence agencies for monitoring suspect activities, gathering intelligence, or conducting covert operations.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

In December 2025, TechCrunch reported that SIO was behind a set of malicious Android apps that masqueraded as WhatsApp and other popular apps but stole private data from a target’s device using a spyware family called Spyrtacus. The\u00a0apps are believed to have been used by a government customer to target unknown victims in\u00a0Italy.<\/p>\n

<\/p>\n

SIO is one of the many Italian companies selling surveillance tools, including Cy4Gate, eSurv, GR Sistemi, Negg, Raxir, and RCS Lab, turning the country into a\u00a0\u00abspyware\u00a0hub<\/a>.\u00bb<\/p>\n

Early last year,\u00a0WhatsApp alerted around 90 users that they were targeted with Paragon Solutions’ spyware known as Graphite. Then, in August 2025,\u00a0it notified less than 200 users who may have been targeted as part of a sophisticated campaign by chaining together zero-day vulnerabilities in iOS and the messaging\u00a0app.<\/p>\n

The development comes a little over a month after a Greek\u00a0court sentenced<\/a> Tal Dilian, the founder of the Intellexa Consortium, and three associates, Sara Hamou, Felix Bitzios, and Yiannis Lavranos, to prison for their role in the illegal use of the\u00a0vendor’s Predator spyware to target politicians, business leaders, and journalists in the\u00a0country.<\/p>\n

The 2022 surveillance scandal, dubbed Predatorgate or Greek Watergate, prompted the European Parliament\u00a0to launch a formal\u00a0inquiry<\/a> into the use of such tools. However, a new law passed that year has since legalized government use under strict conditions. In\u00a0July 2024, the Greek Supreme\u00a0Court cleared<\/a> the state intelligence service and government officials of wrongdoing.\u00a0<\/p>\n

\u00abQuestions remain about the role of the Greek government, which has consistently denied purchasing or using Predator,\u00bb Amnesty International said<\/a>. \u00abTransparency is a crucial part of accountability \u2013 as is remedy for the many victims of the human rights violations brought about by the unlawful use of this technology.\u00bb<\/p>\n

In a statement shared with Reuters late last month,\u00a0Dilian said<\/a> he intends to appeal the decision, adding, \u00abI believe a conviction without evidence is not \u2060justice, it could be part of a cover-up and even a\u00a0crime.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Italy and Greece are far from the only European countries to be caught in the spyware technology’s crosshairs. Back\u00a0in January 2026, Spain’s High\u00a0Court closed its\u00a0probe<\/a> into the use of NSO\u00a0Group’s Pegasus to spy on Spanish politicians, citing a lack of cooperation from Israeli authorities.<\/p>\n

The case dates to May 2022, when the Spanish government disclosed that the Israeli company’s spyware had been used to eavesdrop on devices belonging to Prime Minister Pedro S\u00e1nchez and Defence Minister Margarita\u00a0Robles.<\/p>\n

Companies like Intellexa and NSO Group have consistently maintained that their surveillance technology has only been licensed to governments to fight serious crimes and bolster national security. NSO\u00a0Group’s Executive Chairman David\u00a0Friedman said<\/a> the \u00abworld is a far safer place\u00bb when the\u00a0company’s tools\u00a0\u00abare in the right hands within the right\u00a0countries.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Apr 02, 2026Surveillance \/ Mobile Security Meta-owned messaging platform WhatsApp said it alerted about 200 users who were tricked into installing a bogus version of its iOS app that…<\/p>\n","protected":false},"author":1,"featured_media":472,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1033,940,790,1032,150,535,221,428,1031,1030,826,815],"class_list":["post-471","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-action","tag-alerts","tag-app","tag-faces","tag-fake","tag-firm","tag-installed","tag-ios","tag-italian","tag-spyware","tag-users","tag-whatsapp"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/471","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=471"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/471\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/472"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=471"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=471"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=471"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}