Meta Identifies and Disrupts Spyware Campaign Using Fake WhatsApp App

Meta has identified and disrupted a targeted spyware campaign that deceived approximately 200 users, primarily in Italy, into installing a counterfeit version of the WhatsApp messaging application. The operation has been attributed to ASIGINT, a subsidiary of the Italian surveillance firm SIO.

The malicious application was distributed outside official app stores, employing social engineering tactics to convince users to download and install it. Once installed, the fake app granted unauthorized access to sensitive data on the victims' devices. Meta emphasized that this attack did not exploit any vulnerabilities within the official WhatsApp application, and that end-to-end encryption remains intact for users of the legitimate app.

In response, Meta's security team proactively identified the affected users, logged them out of their accounts, and issued security notifications advising them to remove the counterfeit software and reinstall the official WhatsApp app from trusted sources. The company also announced plans to send a formal legal demand to ASIGINT to cease such malicious activities.

ASIGINT, based in Cantù, Italy, operates under SIO S.p.A., a firm known for developing surveillance technologies for government use. SIO's website describes its offerings as "high-performance, field-proven cyber intelligence solutions and technology."

This incident marks the second time in 15 months that Meta has publicly addressed spyware activities in Italy. In early 2025, a surveillance operation involving spyware from the U.S.-owned firm Paragon was exposed, leading to the termination of the relationship between Italy and Paragon.