Highly advanced spyware that’s capable of stealing WhatsApp messages from victims has been discovered by cyber security researchers.

The malware can “spy extensively” on people, and force their phones to record audio and video and take pictures, and steal text messages and call records, all “without arousing suspicion”, the researchers say.

It has been dubbed “Skygofree”, but it has no connection to Sky or any of its products, and does not affect the Sky Go service. 

Kaspersky Lab describes it as “one of the most advanced mobile implants” it has ever come across, and says it “includes a number of advanced features not seen in the wild before”, which can give an attacker full remote control of an infected device.

One of its most noteworthy features is the ability to steal WhatsApp messages, by making use of the Accessibility Services feature on Android. It doesn’t take advantage of any vulnerabilities in the messenger app itself.

“Upon receiving a specific command, the implant can download a special payload to grab sensitive information from external applications,” Kaspersky Lab says, adding that it found a payload that exclusively targets WhatsApp.

“The payload uses the Android Accessibility Service to get information directly from the displayed elements on the screen, so it waits for [WhatsApp] to be launched and then parses all nodes to find text messages.”

Though it requires a special permission from a victim to carry out the message theft, it can obtain this through the delivery of a deceptive phishing message. 

Skygofree can also “eavesdrop on surrounding conversations and noise when an infected device enters a specified location – a feature that has not previously been seen in the wild”, the researchers say.

The malware can enable an infected phone’s microphone and force it to record everything going on around it.

Kaspersky Lab says it is also capable of taking pictures and videos, seizing call records, text messages, geolocation data, calendar events and business-related information stored in the device’s memory.

The researchers found 48 different commands that can be implemented by attackers, which are listed here. 

They say the malware has been active since 2014 and that the campaign is still ongoing. It has successfully infected “several” victims, all of whom are based in Italy, and is targeting Android and Windows users.

Kaspersky Lab says it has “a high level of confidence that the developer behind the Skygofree implants is an Italian IT company that offers surveillance solutions”, adding that the malware was designed for “targeted cyber-surveillance”.

• READ MIt is 

“If in doubt, call the service provider to verify.”