CISA warns spyware crews are breaking into Signal and WhatsApp accounts
Attackers sidestep encryption with spoofed apps and zero-click exploits to compromise ‘high-value’ mobile users
CISA has warned that state-backed snoops and cyber-mercenaries are actively abusing commercial spyware to break into Signal and WhatsApp accounts, hijack devices, and quietly rummage through the phones of what the agency calls “high-value” users.
In an alert published Monday, the US government’s cyber agency said it’s tracking multiple miscreants that are using a mix of phishing, bogus QR codes, malicious app impersonation, and, in some cases, full-blown zero-click exploits to compromise messaging apps which most people assume are safe.
The agency says the activity it’s seeing suggests an increasing focus on “high-value” individuals – everyone from current and former senior government, military, and political officials to civil society groups across the US, the Middle East, and Europe. In many of the campaigns, attackers delivered spyware first and asked questions later, using the foothold to deploy more payloads and deepen their access.
Related Knowledge Center: Digital privacy and data security
If you’re online, you’re generating a constant stream of information about yourself — sometimes voluntarily, sometimes unwittingly — that is assembled and used to craft your online experience. And generate wealth for data brokers. Meanwhile, designers and managers of the digital infrastructure on which the world depends are engaged in a never-ending effort to thwart attempts, by both criminal enterprises and state actors, to exploit vulnerabilities in those systems.
Signalgate | State surveillance