Spyware Abuse of Signal and WhatsApp Targeting US Officials

The U.S. cyber defense agency warned that cyber threat actors are targeting current and former high-ranking government, military and political officials by using commercial spyware to gain unauthorized access to messaging apps such as Signal and WhatsApp.

See Also: A Modern Approach to Data Security

An advisory from the Cybersecurity and Infrastructure Security Agency highlighted “multiple cyber threat actors actively leveraging commercial spyware to target users of mobile messaging applications” while using “sophisticated targeting and social engineering techniques to deliver spyware and gain unauthorized access” to the victim’s account and device. The alert says evidence suggests threat actors are using phishing and malicious device-linking QR codes to compromise accounts, as well as zero-click exploits “which require no direct action from the device user” and the impersonation of popular messaging apps.

The alert comes months after one of the Trump administration’s first security scandals – dubbed “SignalGate” – in which members of the White House national security team accidentally exposed sensitive planning discussions through a mismanaged Signal group chat that included a reporter. The episode raised questions over why Trump administration officials were handling classified or sensitive exchanges on commercial devices susceptible to hacking (see: TeleMessage Goes Dark After Trump Adviser Photo Fallout).

CISA said evidence points to a focus on high-value individuals, including current and former senior government, military and political officials, along with civil society organizations and at-risk individuals in the United States, the Middle East and Europe. The agency drew attention to three main techniques: phishing and malicious device-linking QR codes that allow an attacker to gain access to a victim account, zero-click exploits that require no interaction from the user and the impersonation of mainstream platforms like Signal and WhatsApp to trick targets into installing spyware or handing over credentials.

CISA pointed to recent research from Google that documented multiple Russian-aligned espionage groups abusing Signal’s “linked devices” feature by pushing victims to scan malicious QR codes that silently connect their accounts to an attacker’s infrastructure. Once the extra device is linked, messages can then be delivered in parallel to the victim and the threat actor, allowing persistent access without needing to fully compromise the victim’s device itself.

The advisory flagged research showing how threat actors increasingly use fully fake messaging apps rather than just phishing pages to trick their victims. Recent reports have revealed how Android spyware families pose as Signal to target users in the United Arab Emirates, with infrastructure built to exfiltrate chat backups, documents, media and contacts from compromised devices.

The alert comes amid an ongoing global crackdown on commercial spyware, including an October ruling from a U.S. federal judge permanently blocking major spyware vendor NSO Group from targeting WhatsApp. A spokesperson for the Meta-owned chat app previously called NSO Group a “notorious foreign spyware merchant” and celebrated the verdict as “an important step forward for privacy and security” (see: US Court Blocks Spyware Maker NSO Over WhatsApp Hack).