Whatsapp Notifies Hundreds Of Users Who Installed A Fake App That Was Actually Government Spyware

Trending 5 days ago
This illustration photograph taken connected December 1, 2025, shows nan logo of US instant messaging package Whatsapp displayed connected a smartphone's screen.Image Credits:Kirill KUDRYAVTSEV / AFP / Getty Images / Getty Images

9:34 AM PDT · April 1, 2026

WhatsApp says it has notified astir 200 users who were tricked into installing a malicious clone type of nan chat app that contained authorities spyware. 

WhatsApp accused Italian spyware shaper SIO of creating a clone type of its messaging app for iPhones, according to an announcement nan institution shared pinch TechCrunch.  

“Our information squad proactively identified astir 200 users chiefly successful Italy who we judge whitethorn person downloaded this malicious unofficial client,” WhatsApp said successful its statement. “We person logged them out, alerted to nan risks to their privateness and information that travel pinch downloading clone unofficial clients, and encouraged them to region it and download nan charismatic WhatsApp app.”

WhatsApp spokesperson Margarita Franklin told TechCrunch that, astatine this point, nan institution cannot stock much accusation astir nan users it notified, specified arsenic whether they were journalists aliases members of civilian society. 

“Our privilege has been protecting nan users who whitethorn person been tricked into downloading this clone iOS app,” said Franklin. 

In its announcement, WhatsApp besides said it plans to “send a general ineligible request to extremity immoderate specified malicious activity to this spyware firm.”

A screenshot of nan notification Whatsapp sent to users informing them to download nan charismatic app. (image: whatsapp)

Italian newspaper La Repubblica and news agency ANSA first reported nan news.

Last year, TechCrunch revealed that SIO was down a bid of malicious Android apps that contained its spyware, including clone versions of WhatsApp, arsenic good arsenic clone customer support devices for cellphone providers. SIO’s spyware was identified pinch nan sanction Spyrtacus, a connection that appeared successful nan spyware’s code.

Contact Us

Do you person much accusation astir SIO, aliases different authorities spyware makers? From a non-work device, you tin interaction Lorenzo Franceschi-Bicchierai securely connected Signal astatine +1 917 257 1382, aliases via Telegram, Keybase and Wire @lorenzofb, aliases by email.

Using clone apps against targets of surveillance is a well-established maneuver utilized by authorities successful Italy, who often get collaboration from cellphone providers, who nonstop phishing links to their customers connected behalf of rule enforcement.

SIO develops authorities spyware done its subsidiary ASIGINT. 

Apple and SIO did not respond to a petition for comment. 

WhatsApp’s latest announcement comes a twelvemonth aft the institution alerted astir 90 users that they had been targeted pinch spyware made by nan U.S.-Israeli surveillance tech shaper Paragon Solutions. WhatsApp sent those notifications to journalists and pro-immigration activists, among others, sparking a wide-ranging ungraded crossed Italy. 

In response, Paragon trim ties pinch Italy’s spy agencies, which were its customers.

Topics

cybersecurity, hacking, Italy, malware, Meta, privacy, Security, SIO, Spyware, surveillance, WhatsApp

Lorenzo Franceschi-Bicchierai is simply a Senior Writer astatine TechCrunch, wherever he covers hacking, cybersecurity, surveillance, and privacy.

You tin interaction aliases verify outreach from Lorenzo by emailing lorenzo@techcrunch.com, via encrypted connection astatine +1 917 257 1382 connected Signal, and @lorenzofb connected Keybase/Telegram.

More