![\"A](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2025\/11\/1763996052_343_0x0.jpg\")
<\/p>\n<\/p>\n
Beware the Sturnus malware attacks that bypass instant messenger encryption to read your texts.<\/p>\n
Photothek via Getty Images<\/p>\n
Updated November 25 with a new warning from America\u2019s Cyber Defense Agency, CISA, regarding how spyware is targeting users of instant messaging applications, as well as further comments from malware experts regarding the Sturnus threat from hackers impacting all secure messenger users.<\/p>\n
Nobody wants their secrets to leak, whether that is the Department of War<\/a>, FTSE 100 companies<\/a>, or your average consumer VPN<\/a> user. One place where many secrets exist is within the encrypted instant messages we send via apps such as Signal, Telegram and WhatsApp. So, what if I were to tell you that a new threat has been identified, targeting Android smartphone users, that effectively bypasses the secure encryption that protects the privacy of your messages, and captures them for cybercriminal hackers to read? Welcome to the distinctly dangerous world of the Sturnus trojan. <\/p>\n ForbesAmazon Issues New Attack Warning For 300 Million CustomersBy Davey Winder<\/a>These Hackers Can Read Your \u2018Private\u2019 Instant Messages<\/p>\n Security researchers at threat intelligence outfit ThreatFabric have confirmed that they have observed a new and dangerous piece of Android malware, a banking trojan that goes beyond the normal boundaries of such malicious software. Not only can Sturnus, which the ThreatFabric analysis said is \u201ccurrently in a development or limited testing phase,\u201d provide hackers with the ability to gain full device control and harvest banking credentials, but also, and here\u2019s the killer blow, it can \u201cbypass encrypted messaging\u201d according to the in-depth technical report<\/a>.<\/p>\n I\u2019m a user of all three of these instant messaging apps, for different use-cases, and rely upon Signal and WhatsApp encryption for some of them. The good news is that this has not been broken, the attackers have not found a way to read your encrypted messages. What they have done, however, is put together a complex technical process that, ultimately, does something very simple indeed: it reads your messages after you\u2019ve decrypted them and they are displayed on the smartphone screen. This harks back to a warning that I used to give people all the time when secure messengers made a big play on the fact that screenshots could be disabled on time-limited, one-hit and done, messages, so the recipient couldn\u2019t take a copy and share it around. They could if they took a photo of the screen with another device. <\/p>\n It\u2019s also a good time to remind people not to download apps from untrusted sources, even if they appear to be a legitimate Google Chrome update, which seems to be one of the distribution methods for the Sturnus malware.<\/p>\n ForbesInternet Domain Name Registration Attacks Confirmed \u2014 What To KnowBy Davey Winder<\/a>Security Expert Reveals Threat From Hackers Posed To All Organizations By The Sturnus Trojan <\/p>\n \u201cSturnus poses a different kind of threat compared to other Android malware due to its ability to use a mix of plaintext, RSA, and AES-encrypted communication with the C2 server it responds to,\u201d is the warning that Aditya Sood, vice president of security engineering and AI strategy at Aryaka, conveyed to me in an email concerning the dangers facing all organizations, rather than just consumers, by this latest trojan malware development. <\/p>\n There\u2019s a lot of technology jargon to unravel there, so let me get that out of the way before going any further. RSA refers to the Rivest, Shamir, and Adleman family of public-key cryptosystems that is still used for secure data transmission, despite being one of the oldest. AES, meanwhile, is the Advanced Encryption Standard, another encryption specification, this time established by the National Institute of Standards and Technology in 2001. The simplest of the three to explain is the C2 server reference, which is the command and control (two C\u2019s, get it?) server involved, in this case Matrix Push C2.<\/p>\n \u201cThe combination of these three,\u201d Sood continued, \u201callows Sturnus to blend more easily into normal network patterns, while also hiding commands and stolen data from defense systems.\u201d And it is this particularly advanced kind of evasion, and resilience, that enables the malware to disrupt signature-based detection and impede reverse-engineering efforts. This, Sood, warned, makes it much \u201charder to inspect Sturnus\u2019 network traffic or recover the contents that it steals.\u201d<\/p>\n Which brings us to the \u2018all organizations\u2019 warning: \u201cThe ability to steal messages from end-to-end encrypted platforms like Signal could spell serious problems for organizations,\u201d Sood concluded, \u201cas those applications are used across several industries to secure sensitive or confidential information.\u201d<\/p>\n ForbesDo Not Download These Windows Security Updates, Experts WarnBy Davey Winder<\/a>Hackers Can Read Everything That Appears On Your Smartphone Screen<\/p>\n \u201cBecause it relies on Accessibility Service logging rather than network interception,\u201d the report said, \u201cthe malware can read everything that appears on screen\u2014including contacts, full conversation threads, and the content of incoming and outgoing messages\u2014in real time.\u201d It is this capability that makes Sturnus particularly dangerous, in the view of the researchers and me, as it side-steps the protection that end-to-end encryption provides. As I\u2019ve often stated, a compromised device is not secure, and nor is anything on it. \u201cThe user sees a secure interface, but from the moment the device is compromised,\u201d the researchers confirmed, \u201cevery sensitive exchange becomes visible to the operator, with no cryptographic protection left to rely on.\u201d<\/p>\n You can read more about instant messenger security here:<\/p>\n Signal<\/a> <\/p>\n Telegram<\/a> <\/p>\n WhatsApp<\/a><\/p>\n So, if you don\u2019t want hackers reading your private stuff, ensure it stays that way by keeping Google\u2019s Play Protect activated, avoiding unauthorized app stores and not giving permission for accessibility controls to be enabled under less there\u2019s a very good reason and you are 101% sure it is safe to do so.<\/p>\n ForbesWhatsApp And Meta Pay Hackers $4 Million \u2014 What To KnowBy Davey Winder<\/a>Cybersecurity And Infrastructure Security Agency Publishes New Warning As Hackers Target Messenger Apps With Spyware<\/p>\n An alert published by the Cybersecurity And Infrastructure Security Agency, known as CISA or as it styles itself \u201cAmerica\u2019s Cyber Defense Agency,\u201d has confirmed the risk faced by users of messaging applications from cyber threat actors employing commercial spyware applications. \u201cThese cyber actors use sophisticated targeting and social engineering techniques to deliver spyware and gain unauthorized access to a victim\u2019s messaging app,\u201d the CISA cybersecurity advisory<\/a> stated, \u201cfacilitating the deployment of additional malicious payloads that can further compromise the victim\u2019s mobile device.\u201d<\/p>\n The tactics employed by even the most advanced hackers looking to target potential victims with the most sophisticated spyware malware are, it has to be said, remarkably familiar to anyone who has read any news report about phishing and spyware attacks over the years. CISA highlighted the following, for example:<\/p>\n Phishing and malicious device-linking QR codes <\/a>to compromise victim accounts and link them to actor-controlled devices.Zero-click exploits<\/a>, which require no direct action from the device user.Impersonation of messaging app platforms, such as Signal and WhatsApp.<\/p>\n Although the vast majority of ordinary users will not be targeted by espionage attackers, nation-state hackers and the like, who tend to focus their valuable time, and valuable spyware assets, on high-profile victims such as politicians, journalists, activists, and the military, the mitigation advice is worth reading as it applies to everyone.<\/p>\n Advice such as remaining vigilant against hackers using social engineering methods, such as claiming an account has been compromised, which requires the recipient to log in to confirm their identity and regain control over their account. Avoiding the scanning of any group-invitation links or QR codes that come from unverified sources. Talking of which, CISA recommends verifying \u201cthe authenticity of group invitations by contacting the group creator or administrator through separate communication channels.\u201d<\/p>\n Then there\u2019s the fine advice to be highly suspicious of all and any unexpected security alert messages, even when they appear to be generated by the application itself, and \u201cespecially if the message requests authentication\u201d by way of PIN code or one-time authentication code. Finally, I\u2019d recommend following the CISA know-how when it says that you should limit linking of devices to only those that are absolutely necessary, which should go without saying, but hey. <\/p>\n","protected":false},"excerpt":{"rendered":"Beware the Sturnus malware attacks that bypass instant messenger encryption to read your texts. Photothek via Getty Images…\n","protected":false},"author":2,"featured_media":303931,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[1121,136409,49,48,7474,20241,136408,136405,61,42876,136407,3632,136406],"class_list":["post-306296","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-android","tag-android-message-hack","tag-ca","tag-canada","tag-malware","tag-signal","tag-signal-hack","tag-sturnus","tag-technology","tag-telegram","tag-telegram-hack","tag-whatsapp","tag-whatsapp-hack"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/306296","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=306296"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/306296\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/303931"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=306296"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=306296"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=306296"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}