State-Backed Spyware Targets Signal and WhatsApp via Devices, Not Crypto

CISA warns that state-backed threat actors are compromising Signal, WhatsApp, and Telegram users by exploiting device vulnerabilities rather than breaking end-to-end encryption. Commercial spyware vendors like Paragon Solutions and Intellexa supply nation-states with tools that read messages after decryption on the endpoint—bypassing cryptographic protections entirely. Attack vectors include zero-day exploits in mobile operating systems (particularly Samsung devices demonstrated by Palo Alto's Landfall spyware discovery), compromised cloud backups, fake QR code linking attacks, and "zero-click" exploits triggered by malformed images. Targets focus on high-value individuals in politics, government, and military sectors, though attacks have expanded across US, Middle East, and European organizations. What's concerning: this shifts the threat model from breaking crypto to compromising devices.