New Italian Spyware "Morpheus" Discovered — Here's How It Secretly Takes Over Your Phone

[cryptoenthusiast]

A previously unknown government spyware called Morpheus has been uncovered by Italian digital rights organization Osservatorio Nessuno, linked to IPS, an Italian surveillance technology company that has been operating for over 30 years. Unlike more advanced spyware makers such as NSO Group, which use invisible zero-click attacks, Morpheus relies on a social engineering trick to get installed. The target's cellphone provider deliberately blocks their mobile data, then sends an SMS prompting them to install what appears to be a phone update app to restore access — when in reality it is the spyware itself.Once installed, Morpheus abuses Android's built-in accessibility features to read on-screen data and interact with other apps.

It then runs a fake update sequence, shows a reboot screen, and spoofs WhatsApp to ask the target for their biometrics — unbeknownst to the victim, that biometric tap grants the spyware full access to their WhatsApp account by silently adding a new device. Researchers believe the attack is related to political activism in Italy, a context where targeted digital surveillance has become increasingly common. IPS, whose website lists several Italian police forces as customers and claims operations in over 20 countries, has not responded to requests for comment.

[johnblockbuster]

android accessibility features: built for users, repurposed for chaos