CISA Warns of Threat Actors Leveraging Commercial Spyware to Target Users of Signal and WhatsApp

Cybersecurity authorities, citing a CISA advisory, warn of active, sophisticated commercial spyware first observed in 2025 that targets secure messaging apps (e.g., Signal, WhatsApp). Attackers use social engineering (phishing, malicious QR codes) and sometimes zero‑click exploits to install Android spyware that requests excessive permissions, persists via services and broadcast receivers, and stealthily exfiltrates messages, contacts, and other sensitive data; infections have been reported across the U.S., Middle East, and Europe and target high-value officials.