The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a new alert warning that threat actors are using commercial spyware to compromise users of encrypted messaging apps including WhatsApp, Signal, and Telegram. The advisory, published on November 24, says multiple groups are abusing these platforms to deliver spyware and gain persistent access to mobile devices, particularly those belonging to high-value targets such as senior government officials, military and political figures, and civil society organizations across the United States, Europe, and the Middle East.
Drawing on recent research from vendors and threat intelligence teams, CISA highlights a cluster of campaigns that abuse messaging features and app ecosystems rather than relying on traditional email phishing. Techniques include malicious QR codes used to hijack "linked devices" features, impersonation of legitimate apps through trojanized installers, and so-called zero-click exploits that compromise devices without any user interaction. Recent cases referenced in the alert and subsequent coverage include Russian state-aligned actors abusing Signal’s device-linking flow to mirror victims’ conversations, the Landfall Android spyware campaign using image files sent over WhatsApp to target Samsung devices, and commercial spyware tools delivered through malicious documents on WhatsApp.
For security leaders, the advisory reinforces that messaging apps are now a key attack surface for identity-centric threats. Compromise of a single device can expose private communications, authentication flows, and contact networks, enabling follow-on phishing and account takeover across both personal and enterprise services. CISA is directing high-risk users to updated Mobile Communications Best Practices guidance and to resources tailored for civil society organizations, urging them to lock down device-linking, apply platform updates promptly, and scrutinize any out-of-band prompts to scan QR codes or install "secure" companion apps.
Sources: Cyberscoop, Cybernews, CISA
—
By the ID Tech Editorial Team
