CISA Has Issued a Warning About an Active Spyware Campaign.

CISA has detected hackers targeting mobile messaging app users and issued a warning that these attackers are using commercial spyware and remote access Trojans to infiltrate devices.

What happens is that hackers use advanced targeting and clever social engineering to insert spyware into your phone, and once inside, they can open your messaging app and gain access to everything inside. That initial breach usually leads to more dangerous software appearing on your device.

CISA has flagged some major attacks this year.

• A group linked to Russia was targeting Signal users. They exploited the “linked devices” feature to take over people’s accounts.
• In the UAE, attackers used spyware called ProSpy and ToSpy. They disguised them as popular apps like Signal and ToTok, tricking people into installing malware that allowed hackers to inhabit their devices and steal all kinds of data.
• A campaign called ClayRat was also observed in Russia. This time, hackers created fake sites like WhatsApp, Google Photos, TikTok, and YouTube and used Telegram channels to spread the links. Those who fell for the scam were then exposed to the spyware and exposed to sensitive information.

These people don’t just send random phishing links; they use methods like zero-click exploits, QR codes for device linking, and fake versions of trusted apps.

Their main targets? High-profile individuals, such as senior government officials, military leaders, politicians, and members of civil society groups. CISA says most of the action is focused on Europe, the Middle East, and the U.S.

If you’re worried about being targeted, CISA has some tips:

For your accounts:

• Use FIDO authentication. It’s much better than passwords or SMS codes.
• Skip SMS for multi-factor authentication. It’s simply not secure enough.
• Get a password manager to keep track of your logins.
• Set up a PIN with your carrier to lock your mobile account.

For your devices:

• Keep all your software updated.
• If possible, upgrade to a newer phone; they’re generally more secure.
• Skip personal VPNs. They don’t provide the protection you need against these types of threats.

For your messages:

• Use messaging apps that use end-to-end encryption.

If you’re on an iPhone:

• Turn on Lockdown Mode.
• Sign up for iCloud Private Relay.
• Check your app permissions and reduce any that aren’t essential.

If you’re using Android:

• Choose a brand known for strong security.
• Use RCS messaging only if it’s end-to-end encrypted.
• Turn on Chrome’s Advanced Protection.
• Make sure Google Play Protect is running.
• Regularly review which apps can access your data and remove any that aren’t.

Frequently Asked Questions (FAQs)