Signal, WhatsApp, and Telegram Security Analysis: The Rise of Sturnus Malware and State-Level Interception

The Sturnus Trojan and the Fallacy of the Secure App\n\nRecent intelligence from security researchers at ThreatFabric has identified a sophisticated new Android trojan dubbed 'Sturnus' that effectively bypasses the end-to-end encryption (E2EE) of Signal, WhatsApp, and Telegram. E2EE is a security protocol where only the communicating users can read the messages, but Sturnus circumvents this by compromising the device's operating system rather than the application's code. By gaining accessibility permissions—a set of Android features designed to assist users with disabilities—the malware captures keystrokes and screen content before the data is even encrypted by the application. This highlights a critical vulnerability in encrypted communications: the security of the app is entirely dependent on the integrity of the underlying hardware and OS. \n\nFor corporate and investigative professionals, the Sturnus discovery serves as a stark reminder that mobile malware is evolving to treat the application layer as transparent. The malware, currently targeting financial institutions across Southern and Central Europe, demonstrates that once a device is compromised, every sensitive exchange becomes visible to the operator. This type of spyware for phones renders traditional software-based encryption moot, as the 'clear-text' data is harvested at the point of user interaction. To mitigate these risks, organizations are increasingly looking toward hardware-modified phones that utilize hardened kernels and restricted execution environments to prevent unauthorized accessibility escalations.\n\n## State-Sponsored Account Hijacking and Phishing Tactics\n\nBeyond automated malware, state-sponsored actors, particularly those linked to Russian intelligence services (SVR and FSB), have intensified their efforts to compromise Signal and WhatsApp accounts through sophisticated phishing and account takeover (ATO) tactics. According to recent warnings from the FBI and Dutch intelligence agencies, these campaigns do not attempt to break the underlying cryptographic protocols like the Signal Protocol. Instead, they exploit human and procedural vulnerabilities, such as stealing verification codes or abusing the 'linked device' feature. \n\nIn these scenarios, threat actors use social engineering to trick users into revealing their Signal PIN or scanning a malicious QR code. Once a threat actor links their own device to a target's account, they gain full access to future messages and, in some cases, historical data stored in cloud backups. This form of mobile surveillance is particularly dangerous because it leaves the user's encryption keys intact while providing the adversary with a clear-text view of all exchanges. Furthermore, the use of cellular interception via SS7 vulnerabilities can be used to intercept the SMS verification codes required to register these new devices, bypassing the need for direct user interaction in some instances. This underscores the necessity of using encrypted phones that support out-of-band authentication and physical security keys.\n\n## Vulnerability Management: Signal’s SSS Patch and the Zero-Click Threat\n\nThe technical landscape of secure messaging is further complicated by the discovery of zero-click vulnerabilities—exploits that require no user interaction to execute. Recent reports from the International Association for Cryptologic Research (IACR) detailed two significant vulnerabilities in Signal’s Secure Shared Storage (SSS) system. These flaws related to missing key checks and the loss of cryptographic context when processing was distributed across multiple software components. While Signal promptly patched these issues, the vulnerabilities could have allowed for undetectable attacks on the app's end-to-end security guarantees. \n\nSimultaneously, the industry has been rocked by reports of a potential zero-click Remote Code Execution (RCE) vulnerability in Telegram. Although Telegram has officially denied these claims, alerts from ZDI and CSIRT Italy have maintained a high level of skepticism among cybersecurity experts. The persistence of these threats, which mirror the capabilities of high-end cellphone spyware, suggests that even the most audited apps are not immune to technical flaws. For those seeking a Pegasus spyware alternative, the focus must shift from the application to a holistic security posture that includes hardware surveillance countermeasures and real-time integrity monitoring via a C2 dashboard.\n\n## Metadata Exposure and the Limits of Mainstream Apps\n\nA critical distinction must be made between the security of message content and the privacy of metadata. While WhatsApp uses the Signal Protocol for E2EE, it is owned by Meta, which collects extensive metadata, including contact lists, usage frequency, and location data. For a public figure or executive, this relationship graph is sensitive data that can be exploited for mobile forensics or traffic analysis. Telegram, conversely, does not use E2EE by default; regular 'cloud chats' are stored on Telegram's servers and are technically accessible by the provider. Only 'Secret Chats' offer true E2EE, but these are limited to one-on-one conversations and lack the multi-device synchronization that users often require.\n\nSignal remains the gold standard for metadata minimization, but as the Sturnus trojan and Russian phishing campaigns show, the app is only as secure as the device it resides on. The reliance on phone numbers for account identification remains a significant privacy hurdle, as it links digital identities to physical SIM cards that are susceptible to cellular interception. Professionals operating in high-risk jurisdictions must recognize that mainstream apps, while superior to SMS, are still subject to endpoint exploitation and state-level pressure.\n\n## Key Takeaway\n\nThe recent emergence of the Sturnus trojan and state-sponsored account hijacking campaigns proves that end-to-end encryption is not a silver bullet. Security is a multi-layered discipline that must extend from the application layer down to the physical hardware. Relying solely on apps like Signal or WhatsApp without addressing endpoint security leaves users vulnerable to sophisticated mobile surveillance. True privacy in the modern era requires a combination of audited encrypted communications and hardened, purpose-built hardware that eliminates the attack surfaces exploited by modern malware.\n\nThis analysis is provided for educational and compliance purposes only; the use of surveillance or counter-surveillance tools is subject to local and international laws.