VajraSpy Proved the Threat Did Not End in 2019
The 2024 VajraSpy investigation supplied another warning. ESET researchers discovered twelve Android espionage applications carrying a remote-access trojan attributed with high confidence to the Patchwork threat group. Six had appeared on Google Play, while the remainder circulated elsewhere. The applications posed mostly as messaging services and used romance-based social engineering to persuade targets to install them.
According to ESET’s technical findings, the campaign predominantly targeted users in Pakistan. Depending on the permissions obtained, VajraSpy could steal contacts, files, call records and text messages; advanced variants could extract WhatsApp and Signal messages, record calls and activate a device’s camera.
Again, the lesson is not that WhatsApp encryption was useless. The lesson is that a compromised phone makes arguments about the messaging application almost secondary. Replacing WhatsApp with WeChat on the same unmanaged handset, while retaining unsafe installation habits, weak passwords, excessive permissions and uncontrolled backups, would amount to changing the lock while leaving the window open.
Why WeChat—and What Does the China Connection Mean?
WhatsApp and WeChat are frequently compared as though they were two versions of the same product. They are not. WhatsApp was developed principally as a communication tool: direct messages, family and workplace groups, calls, media sharing, Channels, Communities and business interaction. WeChat began with communication but grew into a super-app that can combine conversations, payments, mini-programs, official accounts, bookings and other everyday services inside one ecosystem.
A helpful way to understand the distinction is that WhatsApp is primarily a channel through which a conversation moves, whereas WeChat attempts to become the container in which communication, services and transactions coexist. That difference explains why WhatsApp travelled easily across Pakistan, the Middle East and much of the world, while WeChat achieved exceptional depth inside a Chinese digital environment supported by local payment networks, services and regulation.
For Pakistan, choosing WeChat may indicate greater operational comfort with a trusted strategic partner, potential scope for customised arrangements and a desire to reduce dependence on a Western platform controlled outside Pakistan’s legal and security architecture. China and Pakistan already cooperate across defence production, intelligence coordination, telecommunications and critical infrastructure. Extending that relationship into digital communications would not be surprising.
Yet friendship between states cannot substitute for technical verification. Pakistan’s sovereignty is not achieved merely by moving data from an American-controlled ecosystem into a Chinese-controlled one. The same principle applies to cloud computing, an issue explored in why Pakistan’s Sky47 data centre is only the beginning of digital sovereignty, and to national filtering infrastructure examined in Pakistan’s expanding network-surveillance architecture. Sovereignty exists when Pakistan controls encryption keys, devices, identity, metadata, servers, update mechanisms, auditing and the legal conditions governing access—not when it merely selects a friendlier foreign logo.
WeChat Carries Its Own Documented Security Questions
The decision becomes more complicated when independent research into WeChat is considered. Citizen Lab researchers found that documents and images exchanged entirely among non-China-registered accounts underwent content surveillance and could contribute to censorship systems applied to China-registered users. The researchers did not establish that every international text chat was read by a human operator, but their controlled experiments demonstrated that internationally exchanged files were analysed for political sensitivity.
Citizen Lab’s later work also found that the WeChat ecosystem collected more usage data than its policy disclosures clearly described. These findings do not prove that Chinese intelligence automatically receives Pakistani military conversations, nor do they establish that a specially configured military deployment would operate like the ordinary public application. They do, however, destroy any simplistic claim that WeChat is intrinsically private merely because it is Chinese and Pakistan enjoys close relations with Beijing.
| Security dimension | Military implication | ||
|---|---|---|---|
| Default message encryption | Personal messages and calls use end-to-end encryption by default | Public documentation does not provide an equivalent universal E2EE assurance for ordinary WeChat messaging | Consumer WeChat should not automatically be presumed suitable for classified traffic |
| Ecosystem design | Primarily communications-focused | Super-app integrating communication, services and transactions | A broader platform creates more functionality but potentially more data exposure |
| Known security concern | Spyware, malicious links, account takeover, backups and endpoint compromise | Content surveillance, data collection and censorship-related processing documented by researchers | Both require independent technical assessment |
| Sovereign control | Meta controls the public platform | Tencent controls the public platform | Pakistan controls neither public platform by default |
| Proper defence use | Low-sensitivity coordination at most, under strict policy | Low-sensitivity coordination at most unless specially secured | Classified operations require a sovereign communications system |
The strategic question, therefore, is not whether China is a reliable Pakistani partner. It plainly is one of Pakistan’s most consequential defence and economic partners. The question is whether Pakistan will negotiate a controlled, auditable and preferably domestically hosted communications environment—or merely instruct personnel to install the same public WeChat application available to civilians.
