Skip to main content
Customer Support Customer Support

Alert ​​Spyware Allows Cyber Threat Actors to Target Users of Messaging Applications​ Release Date November 24, 2025

  • November 24, 2025
  • 1 reply
  • 16 views
TripleHelix
Moderator
Forum|alt.badge.img+63

CISA is aware of multiple cyber threat actors actively leveraging commercial spyware to target users of mobile messaging applications (apps).1 These cyber actors use sophisticated targeting and social engineering techniques to deliver spyware and gain unauthorized access to a victim’s messaging app, facilitating the deployment of additional malicious payloads that can further compromise the victim’s mobile device.  

These cyber actors use tactics such as:

  • Phishing and malicious device-linking QR codes to compromise victim accounts and link them to actor-controlled devices.
  • Zero-click exploits,2 which require no direct action from the device user.
  • Impersonation3 of messaging app platforms, such as Signal and WhatsApp.

While current targeting remains opportunistic, evidence suggests these cyber actors focus on high-value individuals, such as current and former high-ranking government, military, and political officials,4 as well as civil society organizations (CSOs) and individuals across the United States,5 Middle East,6 and Europe.7

CISA strongly encourages messaging app users to review the updated Mobile Communications Best Practice Guidance and Mitigating Cyber Threats with Limited Resources: Guidance for Civil Society for steps to protect mobile communications and messaging apps, as well as mitigations against spyware.

Notes

1 Dan Black, “Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger,” Google Threat Intelligence (blog), Google, last updated February 19, 2025, https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger/

. 

2 Unit 42, “LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices,” Threat Research (blog), Unit 42, Palo Alto Networks, last updated November 7, 2025, https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/

; and Ravie Lakshmanan, “WhatsApp Patches Zero-Click Exploit Targeting iOS and macOS Devices,” The Hacker News,  August 30, 2025, https://thehackernews.com/2025/08/whatsapp-issues-emergency-update-for.html

. 

3 Vishnu Pratapagiri, “ClayRat: A New Android Spyware Targeting Russia,” Zimperium (blog), Zimperium, October 9, 2025, https://zimperium.com/blog/clayrat-a-new-android-spyware-targeting-russia; Bill Toulas, “Android Spyware Campaigns Impersonate Signal and ToTok Messengers,” Bleeping Computer, October 2, 2025, https://www.bleepingcomputer.com/news/security/android-spyware-campaigns-impersonate-signal-and-totok-messengers/

; and Pierluigi Paganini, “ClayRat Campaign Uses Telegram and Phishing Sites to Distribute Android Spyware,” Security Affairs, October 9, 2025, https://securityaffairs.com/183169/malware/clayrat-campaign-uses-telegram-and-phishing-sites-to-distribute-android-spyware.html

. 

4 Courtney Rozen, “WhatsApp Banned on US House of Representatives Devices, Memo Shows,” Reuters, June 23, 2025, https://www.reuters.com/world/us/whatsapp-banned-us-house-representatives-devices-memo-2025-06-23/

; and Andrew Solender, “WhatsApp Banned on House Staffers' Devices,” Axios, June 23, 2025, https://www.axios.com/2025/06/23/whatsapp-house-congress-staffers-messaging-app

. 

5 Suzanne Smalley, “Judge Bars NSO from Targeting WhatsApp Users with Spyware, Reduces Damages in Landmark Case.” The Record, October 20, 2025, https://therecord.media/judge-bars-nso-from-targeting-whatsapp-users-lowers-damages

.

6 Suzanne Smalley, “Researchers Uncover Spyware Targeting Messaging App Users in the UAE,” The Record, October 2, 2025, https://therecord.media/researchers-spyware-uae-infections

.

7 Paganini, “ClayRat Campaign Uses Telegram and Phishing Sites to Distribute Android Spyware.

https://www.cisa.gov/news-events/alerts/2025/11/24/spyware-allows-cyber-threat-actors-target-users-messaging-applications?utm_source=https://www.cisa.gov/news-events/alerts/2025/11/24/spyware-allows-cyber-threat-actors-target-users-messaging-applications&utm_medium=GovDelivery

Daniel - Microsoft MVP Consumer Security (2012-2016) Windows 10 Pro x64 for Workstations 22H2 on my Alienware 17R2 and Windows 11 Pro x64 for Workstations on my Alienware 17R5 Laptops with Webroot SecureAnywhere Complete Beta Tester for PC & Android Samsung Galaxy A16 5G OS 16.
ProTruckDriver
Ssherjj
TripleHelix

1 reply

TripleHelix
Moderator
Forum|alt.badge.img+63
  • TripleHelix
  • Author
  • Moderator
  • November 25, 2025

CISA warns spyware crews are breaking into Signal and WhatsApp accounts

 

Attackers sidestep encryption with spoofed apps and zero-click exploits to compromise 'high-value' mobile users

 

Tue 25 Nov 2025

 

CISA has warned that state-backed snoops and cyber-mercenaries are actively abusing commercial spyware to break into Signal and WhatsApp accounts, hijack devices, and quietly rummage through the phones of what the agency calls "high-value" users.

In an alert published Monday, the US government's cyber agency said it's tracking multiple miscreants that are using a mix of phishing, bogus QR codes, malicious app impersonation, and, in some cases, full-blown zero-click exploits to compromise messaging apps which most people assume are safe.

The agency says the activity it's seeing suggests an increasing focus on "high-value" individuals – everyone from current and former senior government, military, and political officials to civil society groups across the US, the Middle East, and Europe. In many of the campaigns, attackers delivered spyware first and asked questions later, using the foothold to deploy more payloads and deepen their access.

"CISA is aware of multiple cyber threat actors actively leveraging commercial spyware to target users of mobile messaging applications," the agency said. "These cyber actors use sophisticated targeting and social engineering techniques to deliver spyware and gain unauthorized access to a victim's messaging app, facilitating the deployment of additional malicious payloads that can further compromise the victim's mobile device."

 

The campaigns CISA flags in its bulletin show attackers doing what they do best: sidestepping encryption entirely by spoofing apps, abusing account features, and exploiting the phones underneath them.

For example, Google's Threat Intelligence Group in February detailed how multiple Russia-aligned crews, including Sandworm and Turla, attempted to snoop on Signal users by abusing the app's "linked devices" feature. By coaxing victims into scanning a tampered QR code, the operators could quietly add a second, attacker-controlled device to the account. Once paired, new messages flowed to both ends in real time, letting Moscow's finest eavesdrop.

 

https://www.theregister.com/2025/11/25/cisa_spyware_gangs/

Daniel - Microsoft MVP Consumer Security (2012-2016) Windows 10 Pro x64 for Workstations 22H2 on my Alienware 17R2 and Windows 11 Pro x64 for Workstations on my Alienware 17R5 Laptops with Webroot SecureAnywhere Complete Beta Tester for PC & Android Samsung Galaxy A16 5G OS 16.
Jasper_The_Rasper
Ssherjj
TripleHelix
Terms & ConditionsAccessibility statement