Malware attacks are getting more and more advanced by the day at an alarming rate. Very recently, Apple started rolling out an iOS 18 update to combat the DarkSword malware and now, a small group of WhatsApp users have fallen prey to a spyware-grade malware.
A New Fake WhatsApp APK Hides Government-Grade Spyware
Back in November 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued a directive identifying "Spyrtacus" as the latest malware and spyware that is affecting smartphone users in Italy. Now, WhatsApp has started sending out emergency alerts to users as the Spyrtacus software is being disguised as a WhatsApp APK client and has already managed to infect around 100 users.
In an official announcement, a WhatsApp spokesperson shared with tech publication TechCrunch that spyware maker SIO is responsible for the current fiasco. Most importantly, preliminary studies show that Spyrtacus managed to exploit system-level vulnerabilities in iPhones to infect WhatsApp users on iPhones.
Our security team proactively identified around 200 users primarily in Italy who we believe may have downloaded this malicious unofficial client. We have logged them out, alerted [them] to the risks to their privacy and security that come with downloading fake unofficial clients, and encouraged them to remove it and download the official WhatsApp app. Our priority has been protecting the users who may have been tricked into downloading this fake iOS app."
— Margarita Franklin, WhatsApp Spokesperson
However, this is not the first instance of WhatsApp spyware, especially in Italy. In 2025, SIO managed to infect thousands of Android phones and even then, WhatsApp was used as a backdoor client to gain access. Hence, the popularity and daily reliance of millions of users have made it a prime ground zero for targeted attacks.
In its report, CISA has confirmed that Spyrtacus is a government-grade spyware program and once a device is infected, it is nearly impossible to save it. The spyware gains access to the entire phone, from personal data to kernel-level system commands. Users will not even be able to notice anything odd or suspect anything foul, making the malware almost hard to detect.
That said, several security analysts online suspect Spyrtacus to be a state-funded surveillance program, designed by the Italian government to violate citizens' rights. This belief stems from the fact that SIO operates under the guise of Asigint, which has been instrumental in developing several of the Italian government's cybersecurity tools, databases and infrastructure.
Hence, with the rise in such dangerous APKs and bad actors, it is prudent for both Android and iPhone users to stick to official sources like the Play Store and App Store to download apps, especially WhatsApp. In India, with cyber frauds affecting lakhs of users daily, it is extra important for us to double-check and verify all the links that we click, the websites that we visit and the apps that we download and use on our phones.
