Spyware Morpheus Can Secretly Peek into WhatsApp Chats: Here's How to Prevent It

Android phone users must exercise greater caution when updating their systems or applications, particularly if they receive links directing them to unofficial sources. This is because researchers have discovered a spyware called Morpheus that disguises itself as a fake application (spoofing), enabling it to access WhatsApp (WA) conversation contents without the user’s awareness. This finding was revealed by the Italian digital rights organisation Osservatorio Nessuno. In its report, Morpheus is described as malware capable of stealing various data from target devices, ranging from screen activities to access to messaging apps like WhatsApp. When users are careless and unwary, this malware can install easily and harm victims. Morpheus is a spyware designed to monitor user activities on Android devices. The malware masquerades as a system update application, so victims do not realise that the installed app is actually malicious. Researchers link Morpheus to the Italian company IPS, which has operated for over 30 years providing lawful interception technology. This technology is typically used by governments or law enforcement to monitor communications in real-time via network operators. According to available information, IPS operates in more than 20 countries. However, it is not detailed in which countries the spyware has been used. Researchers also do not disclose the identities of targets, though they mention the possibility of connections to political activities in Italy. Victims then receive an SMS that appears official, as if from the operator. The message usually contains a link, directing the target to click it. The pretext is often for system updates or fixing connections to reconnect to the network. Once the application is installed, the spyware requests accessibility permissions on Android. This feature allows the app to read screen contents and interact with other applications. In this case, the feature is abused to access user data. Subsequently, Morpheus displays a fake update process, including a reboot screen. After that, the spyware impersonates WhatsApp and requests biometric verification or PIN. Unbeknownst to the user, this action grants access to the WhatsApp account, for example, by adding a new device to the victim’s account. With this access, perpetrators can read WhatsApp chats in real-time, monitor screen activities, and access various other data on the device.