Summary: WhatsApp said on Wednesday that an Italian surveillance firm tricked about 200 people into installing a malicious program that mimicked its messaging application in order to surveil targets. The messaging platform, which is owned by Meta Platforms, attributed the operation to ASIGINT, a unit of SIO based in northern Italy.
In its disclosure, WhatsApp described the episode as "highly targeted," saying the perpetrators used deception to convince victims to download "malicious software that impersonated WhatsApp." The company added that the affected accounts were "primarily" located in Italy but did not provide further identifying details about who the victims were.
SIO's public website describes the firm as offering "high-performance, field-proven cyber intelligence solutions and technology." It also states that SIO partners with "Law Enforcement Agencies, Government Organizations, Police and Intelligence Agencies." WhatsApp said the operation was conducted by ASIGINT, which it identified as a subsidiary of SIO.
Requests for comment to SIO went unanswered. Italy's interior ministry referred questions to police, and police likewise did not reply to inquiries, according to WhatsApp's statement.
This development marks the second time in 15 months that Meta has publicly called out spyware activity tied to Italy. The company noted the country is still grappling with fallout from a surveillance campaign exposed in early 2025 that involved spyware produced by a U.S.-owned firm called Paragon. WhatsApp said that, subsequent to that exposure, Italy and Paragon ended their relationship.
Details of the disclosure
WhatsApp provided limited public detail beyond attributing the campaign to ASIGINT and describing the method used to deploy the spyware: a fraudulent WhatsApp application designed to impersonate the legitimate service. The messaging platform emphasized the targeted nature of the operation but declined to name specific victims or offer technical indicators in its announcement.
Responses from parties involved
SIO did not respond to requests for comment. Italy's interior ministry redirected questions to national police, and authorities did not respond publicly to WhatsApp's inquiries, according to the company's report.
Context
WhatsApp's statement ties into a broader sequence of disclosed surveillance activity in Italy, including the earlier operation linked to Paragon in early 2025. That prior episode prompted the end of the relationship between Italy and Paragon, a development referenced by WhatsApp in its announcement.
Because WhatsApp's disclosure contains limited detail about the identities of affected users and the technical specifics of the malicious software, several questions remain open about the full scope and mechanics of the campaign.