WhatsApp Notifies Hundreds of Users Targeted by Fake App from Government Spyware Maker

Add us on Google

WhatsApp has sent urgent alerts to hundreds of users worldwide after discovering they installed a malicious fake version of the messaging app created by a known government spyware vendor.

The alerts warned recipients that their devices were likely compromised by sophisticated spyware capable of stealing messages, contacts, photos, and location data. The fake app was distributed through phishing links and third-party websites mimicking the official WhatsApp download page.

According to security researchers, the malicious app was developed by a company with ties to government surveillance programs. Once installed, it could bypass standard security checks and gain deep access to the victim’s phone, including encrypted chats and two-factor authentication codes.

WhatsApp’s Threat Intelligence team acted quickly after detecting the campaign, notifying affected users directly through in-app messages and recommending immediate actions: uninstall the fake app, run a full device scan, change passwords, and enable two-factor authentication where possible.

This incident highlights the growing risk of state-linked actors using trojanized apps to target journalists, activists, opposition figures, and business leaders. The use of a fake WhatsApp app is particularly effective because the legitimate app is one of the most widely used communication tools globally, especially in regions with high mobile penetration like Africa, Latin America, and parts of Asia.

Meta, WhatsApp’s parent company, has not named the spyware maker publicly but confirmed the campaign involved “government-sponsored” actors. The company continues to monitor similar threats and has strengthened detection mechanisms for fake app distribution.

For affected users, the key message from WhatsApp is straightforward: treat any WhatsApp download from outside official app stores with extreme caution and act immediately on security notifications.

The episode serves as a timely reminder that even popular, end-to-end encrypted apps are not immune to advanced persistent threats when users are tricked into installing compromised versions.