Messaging platform Meta WhatsApp said it has warned about 200 users who were tricked into installing a fake version of its iOS app that was infected with spyware.
According to reports from the Italian newspaper La Repubblica and the news agency ANSA, most of the targets are located in Italy. It is estimated that threat actors have used social engineering techniques to get users to install malicious software that mimics WhatsApp.
All affected users have been logged out and advised to uninstall the malware-infected apps and download the official WhatsApp app. WhatsApp did not disclose who was the target of these attacks.
The tech giant said it is also taking action against Asigint, the Italian subsidiary of spyware company SIO, for allegedly creating a fake version of WhatsApp.
On its website, the company advertises solutions to law enforcement agencies, government agencies, and police and intelligence agencies for tracking the activities of suspects, gathering intelligence, or conducting covert operations.
In December 2025, TechCrunch reported that SIO was behind malicious Android apps that pretended to be WhatsApp and other popular apps but stole private data from the target device using the Spyrtacus family. The devices are believed to have been used by a government client to target unknown victims in Italy.
SIO is one of many Italian companies selling surveillance equipment, including Cy4Gate, eSurv, GR Sistemi, Negg, Raxir, and RCS Lab, turning the country into a “spyware hub.”
Early last year, WhatsApp warned about 90 users that they were exposed to Paragon Solutions’ spyware known as Graphite. Then, in August 2025, it notified less than 200 users who may have been targeted as part of a sophisticated campaign by combining blank date vulnerabilities on iOS and the messaging app.
This development comes more than a month after a Greek court sentenced Tal Dilian, founder of the Intellexa Consortium, and three of his colleagues, Sara Hamou, Felix Bitzios and Yiannis Lavranos, to prison for their role in the illegal use of vendor Predator spyware to target politicians, business leaders and journalists in the country.
The 2022 surveillance scandal, called Predatorgate or the Greek Watergate, prompted the European Parliament to conduct an official investigation into the use of such devices. However, a new law passed that year has allowed the government to use it under strict conditions. In July 2024, the Supreme Court of Greece cleared the country’s media and government officials of criminal charges.
“Questions remain about the role of the Greek government, which has refused to buy or use the Predator,” Amnesty International said. “Transparency is an important part of accountability – as a remedy for the many victims of human rights violations brought about by the illegal use of this technology.”
In a statement shared with Reuters late last month, Dilian said he intends to appeal the decision, adding, “I believe that a sentence without evidence is unfair, it can be part of a cover-up and even a crime.”
Italy and Greece are far from the only European countries to be caught in the crosshairs of spyware technology. Back in January 2026, the Spanish Supreme Court closed its investigation into the NSO Group’s use of Pegasus to spy on Spanish politicians, citing a lack of cooperation from Israeli authorities.
The case began in May 2022, when the Spanish government revealed that an Israeli company’s spyware had been used to listen to the devices of Prime Minister Pedro Sánchez and Defense Minister Margarita Robles.
Companies such as Intellexa and NSO Group have consistently maintained that their surveillance technology is licensed by governments only to fight serious crimes and strengthen national security. NSO Group CEO David Friedman said “the world is a much safer place” when the company’s assets are “in the right hands within the right countries.”
#WhatsApp #Alerts #Users #Fake #iOS #App #Installs #Spyware #Italian #Factory #Faces #Process