Encrypted Messaging Under Siege: Analyzing Sturnus Malware and State-Sponsored Hijacking

The Sturnus Breach: Bypassing E2EE at the Endpoint\n\nThe recent surge in attacks against Signal, WhatsApp, and Telegram marks a strategic shift in global cyber warfare. According to recent reports from the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI, threat actors are no longer attempting to break the underlying cryptographic protocols of these applications. Instead, they are deploying sophisticated mobile malware like the Sturnus trojan to compromise the device endpoint directly. Sturnus, a multi-threat Android banking trojan, has been observed bypassing the end-to-end encryption (E2EE) of Signal and WhatsApp by scraping message content from the screen after it has been decrypted for the user Hackers Bypass Signal, Telegram And WhatsApp Encryption To Read Messages.\n\nThis method of attack is particularly insidious because it targets the device's accessibility services. By gaining permission to monitor the screen, the malware can capture every sensitive exchange in real-time, rendering the "gold standard" of encrypted communications effectively moot. The user sees a secure, locked interface, but the operator of the malware sees the raw text. This highlights a critical reality for corporate and investigative professionals: encryption protects data in transit, but it cannot protect data on a compromised handset. For those operating in high-threat environments, the reliance on standard consumer devices is increasingly dangerous, necessitating a move toward hardware-modified phones that can detect and block such unauthorized process injections.\n\n## State-Sponsored Hijacking: The Dutch and German Intelligence Alerts\n\nBeyond malware, the integrity of secure messaging is being undermined by sophisticated social engineering. Dutch and German intelligence agencies have issued urgent warnings regarding state-sponsored phishing campaigns targeting high-ranking individuals and government employees Russian government hackers targeting Signal and WhatsApp users, Dutch spies warn. Russian-aligned actors are reportedly impersonating "Signal Support" to trick users into revealing account verification codes and PINs. Once a code is obtained, the attacker can register the account on a new device, effectively performing a form of cellular interception at the identity layer.\n\nThis campaign does not require a zero-click exploit or expensive cellphone spyware. Instead, it leverages the trust users place in the platform's brand. According to the Dutch General Intelligence and Security Service (AIVD), the hackers use these hijacked accounts to impersonate the target, access contact lists, and potentially monitor future communications if the victim is locked out of their account. While Signal's architecture ensures that chat history is stored locally and not on their servers, the ability for an adversary to take over a live identity allows for devastating man-in-the-middle attacks and the distribution of further mobile malware to the victim's network.\n\n## The Metadata Trap: Signal vs. WhatsApp vs. Telegram\n\nWhile the headlines focus on active breaches, the structural differences between these apps remain a primary concern for compliance and OPSEC professionals. Signal remains the most robust option due to its open-source protocol and minimal metadata retention. In contrast, WhatsApp, while using the same Signal protocol for content, is owned by Meta and collects extensive metadata, including who you message, when, and how often Signal, WhatsApp, Telegram – which can you really trust?. For an executive or investigative journalist, this relationship graph is a goldmine for mobile surveillance and traffic analysis.\n\nTelegram presents a different set of risks. It is often misunderstood by the public; it does not use E2EE by default. Regular "cloud chats" are stored on Telegram's servers, where they are technically accessible to the service provider. Only "Secret Chats" provide true end-to-end encryption, and these are not synchronized across devices. This lack of default encryption makes Telegram a high-risk environment for sensitive corporate data, as a server-side compromise or a legal subpoena could expose years of communication history. Professionals seeking a Pegasus spyware alternative must prioritize platforms that offer E2EE by default and minimize the metadata footprint that can be exploited by cellular interception tools.\n\n## Hardening the Endpoint: Beyond Software Solutions\n\nAs the threat landscape evolves from protocol attacks to endpoint compromise, the defensive strategy must shift toward hardware integrity and mobile forensics. Standard smartphones are vulnerable to hardware surveillance and the silent installation of spyware for phones via malicious links or QR codes. To combat this, organizations are increasingly adopting a centralized C2 dashboard to monitor the security posture of their mobile fleet, ensuring that accessibility settings are not being abused by trojans like Sturnus.\n\nFurthermore, the use of AI tools by threat actors to mimic familiar voices or identities in phishing attacks means that technical controls must be paired with rigorous behavioral protocols. Disabling automatic image downloads, avoiding URL previews, and utilizing hardware-based security keys for account recovery are no longer optional for high-risk users. The goal is to create a layered defense where the security of the communication does not rely solely on the app, but on the verified integrity of the entire mobile ecosystem.\n\n## Key Takeaway\n\nThe security of Signal, WhatsApp, and Telegram is currently being challenged not by flaws in their encryption, but by the vulnerability of the devices they run on and the users who operate them. The emergence of Sturnus malware and state-sponsored account hijacking proves that E2EE is only one component of a secure communication strategy. True privacy in the modern era requires a combination of hardened hardware, metadata minimization, and a constant vigilance against social engineering. For those whose lives or livelihoods depend on secrecy, the message is clear: the app is only as secure as the phone in your hand.\n\nNote: The information provided is for educational and professional compliance purposes only; the use of surveillance tools is subject to local and international laws.