Encrypted Messaging Under Siege: CISA Warns of Sturnus and LandFall Spyware

The Fallacy of Protocol Immunity: Analyzing the CISA Spyware Alert

The Cybersecurity and Infrastructure Security Agency (CISA) issued a critical alert on November 24, 2025, confirming that threat actors are successfully using commercial spyware to compromise users of Signal, WhatsApp, and Telegram. This warning marks a significant shift in the threat landscape, moving away from attempts to break the underlying cryptography of these apps and toward the total compromise of the host device. For corporate and investigative professionals, the message is clear: end-to-end encryption (E2EE) is no longer a sufficient defense when the operating system itself is compromised. E2EE is a security standard where only the communicating users can read the messages, but it cannot protect data that is captured at the point of entry or display. As encrypted communications become the standard for sensitive operations, threat actors have pivoted to cellphone spyware that intercepts data before it is ever encrypted by the application.

CISA’s rare public warning highlights that highly targeted individuals, including government employees and journalists, are being hit with sophisticated social engineering and zero-click exploits. A zero-click exploit is a type of mobile malware that requires no interaction from the user to infect a device, often delivered through a hidden message or a malformed data packet. The agency’s guidance suggests that the era of relying solely on consumer-grade software for high-stakes privacy is ending, as the gap between application security and operating system vulnerability continues to widen.

Sturnus and LandFall: A New Generation of Mobile Malware

Recent intelligence reports have identified two primary threats currently bypassing the protections of the world’s most popular secure messaging apps: the Sturnus trojan and the LandFall spyware. The Sturnus trojan specifically targets Android users by abusing the operating system's accessibility services. By gaining these permissions, the malware can effectively 'read' the screen and 'scrape' content from Signal, Telegram, and WhatsApp in real-time. This method of mobile surveillance renders the Signal Protocol irrelevant because the data is stolen from the user interface (UI) layer, long after it has been decrypted for the recipient to read. This highlights a critical vulnerability in standard consumer devices where the software environment is not sufficiently isolated from malicious processes.

Simultaneously, the LandFall spyware has been observed exploiting a critical zero-day vulnerability in Samsung mobile devices. According to reports from Bleeping Computer, this exploit is delivered via WhatsApp messages, allowing attackers to gain kernel-level access to the device. Once the kernel is compromised, the attacker has total control, enabling cellular interception of voice calls, camera access, and the exfiltration of message databases. This level of access is comparable to the capabilities of NSO Group’s Pegasus, leading many security analysts to seek a Pegasus spyware alternative that focuses on hardware-level hardening rather than just software patches. The LandFall campaign demonstrates that even the most secure apps are vulnerable if the underlying hardware and kernel can be subverted through a single incoming message.

The Linked-Device Vulnerability: QR Codes as Interception Vectors

Beyond direct malware infection, threat actors are increasingly utilizing 'session hijacking' through legitimate app features. Both Signal and WhatsApp allow users to link their accounts to secondary devices, such as a desktop computer, by scanning a QR code. CISA and the FBI have warned that Russian intelligence services and other state-sponsored actors are using 'QR tricks' to trick victims into pairing their accounts with an attacker-controlled machine. Once a device is linked, the attacker receives a real-time mirror of all incoming and outgoing encrypted communications, often without the victim receiving a persistent notification.

This technique bypasses the need for complex mobile forensics or expensive zero-day exploits. It relies on the user's trust in the application's ecosystem. For professionals managing sensitive data, this necessitates a move toward hardware-modified phones that can disable or strictly control the ability to link devices or use cameras for QR scanning. Furthermore, the use of a C2 dashboard for monitoring organizational device health has become essential to detect unauthorized linked sessions or unusual data exfiltration patterns that characterize these sophisticated account takeovers.

Mitigating Endpoint Risk: From Standard Devices to Hardware-Modified Solutions

The current wave of attacks proves that the 'Gold Standard' of messaging—Signal—is only as secure as the glass and silicon it runs on. When a device is targeted by hardware surveillance or advanced cellphone spyware, the software-based protections of the app are effectively neutralized. Standard consumer smartphones are designed for convenience, often leaving 'backdoors' in the form of diagnostic ports, unhardened bootloaders, and overly permissive operating systems that malware like Sturnus can easily exploit.

To counter these threats, high-risk individuals are increasingly turning to hardware-modified phones. These devices are stripped of non-essential components, such as GPS, microphones, and cameras, or equipped with physical kill-switches that prevent mobile surveillance even if the OS is compromised. By reducing the attack surface at the physical layer, these devices provide a level of security that software updates alone cannot achieve. In an environment where CISA warns that all mobile communications should be assumed at risk of interception, the transition from 'secure apps' to 'secure endpoints' is the only logical progression for professional operational security (OPSEC).

Key Takeaway

The recent CISA alerts and the emergence of Sturnus and LandFall spyware confirm that the battle for mobile privacy has moved from the network layer to the endpoint. While Signal, WhatsApp, and Telegram maintain robust encryption protocols, they cannot defend against malware that captures data directly from the device's memory or screen. Professionals must recognize that encrypted phones are only truly secure when the hardware itself is hardened against mobile malware and zero-click exploits. Relying on consumer-grade hardware for sensitive communications is no longer a viable strategy in the face of state-sponsored mobile surveillance.

Note: The information provided herein is for educational and professional security analysis purposes only; the use of surveillance tools is subject to strict legal and regulatory frameworks.