Debunked

SafeW's "Clarification" Is Really a Whitewashing Campaign

In early January 2026, after users in China publicly exposed SafeW's security problems, a wave of suspiciously identical "explainer" and "debunking" articles quickly appeared online — ghost-written and posted under fake "ordinary user" identities to recast the whole thing as a misunderstanding. This page lays out each of those whitewash claims and rebuts it one by one against Kaspersky's public evidence. You do not have to take anyone's word for it — open the report and check for yourself.

How it started

The exposure came first; this wave of "debunking" came after

The order matters: the exposure came first, the spun articles came after. The issue was put squarely on the table in public twice — in February 2025 and again in January 2026, it was widely exposed and discussed across multiple large Telegram groups and channels. Only then, within a short window, did multiple sites simultaneously put out articles with near-identical wording, all dedicated to deflecting attention away from SafeW. A product that genuinely had nothing to hide would not need a batch of articles like this to "put out the fire."

Where the exposure started: the issue was made public twice — in February 2025 (named by Kaspersky) and in January 2026 (across multiple large Telegram groups and channels). The Facebook post below is one archived example from the 2026 round, so you can read the original wording of the exposure at the time.
Point by point

Whitewash claim × public fact

For each item below, the claim from the spun defense articles is on top, and the fact — checked against public evidence — is underneath.

WHITEWASH CLAIM DEBUNKED

"It's perfectly normal for an app to request photo-library permission — nothing to worry about."

View the original →

FACT

No one says that "requesting photo-library permission" is itself illegal — a normal chat app needs that permission so you can send pictures. The problem was never "whether it has the permission," but what SafeW did with that permission behind your back.

Kaspersky found that it scans your photo screenshots one by one in the background with optical character recognition (OCR), specifically hunting for the recovery phrases, private keys, and passwords of crypto wallets, and uploads any matching image to the attackers. Equating "sending pictures needs photo-library permission" with "using photo-library permission to rifle through your safe in the background" is a textbook bait-and-switch that dodges the real issue, designed to fool people who don't understand the technology.

WHITEWASH CLAIM DEBUNKED

"The people who got infected downloaded the wrong app themselves and installed a counterfeit, knock-off SafeW."

View the original →

FACT

What Kaspersky publicly named are the package names / Bundle IDs of the versions officially published by SafeW on the App Store and Google Play — com.safew.messenger on iOS, and org.safew.messenger and org.safew.messenger.store on Android. These are the one and only official, publicly released identifiers in the app stores, and they match the official app exactly.

How could the genuine app, downloaded through the official channels of Apple's and Google's own stores, be a "fake you downloaded by mistake"? Taking the officially published versions that were implanted with malicious code and insisting it was "the user's download error" is shifting the blame onto the victims. And anyone can verify it for themselves — just open the Kaspersky report and search for safew: the names called out are the official package names, and the "you downloaded the wrong version" line simply does not hold.

WHITEWASH CLAIM DEBUNKED

"SafeW is fully HIPAA compliant."

View the original →

FACT

HIPAA is a U.S. law about health information. It governs how hospitals, health insurers, and health-data organizations protect patients' medical records. It has nothing whatsoever to do with an ordinary instant-messaging app.

A chat app claiming to be "fully HIPAA compliant" is like a bubble-tea shop claiming it "passed aircraft airworthiness certification" — that has nothing to do with compliance; it's just dressing yourself up with an impressive-sounding label that doesn't even apply, and frankly it's laughable. This kind of mismatched "compliance" spin is exactly what proves its security marketing is a completely fake gimmick.

A pattern worth noting: these articles tend to appear on different sites at the same time, with highly similar arguments and wording, yet they all conveniently avoid the core point — "the officially published versions were implanted with data-stealing code" — and instead get bogged down in side issues like "the permission is normal" and "you downloaded the wrong version." More tellingly, most of them are not signed in SafeW's official name; instead, people are recruited to pose as ordinary users and post them as neutral third-party "explainers," so the whitewashing looks like impartial grassroots opinion. A product that is genuinely in the clear does not need this kind of manufactured "public sentiment" to vouch for itself.
The contrast

This is not how you actually prove you're in the clear

If a piece of security software really were wrongly accused, what would it do? Compare that with what SafeW actually did, and it becomes clear.

If genuinely wronged, this is what you'd do

Publish a technical post-mortem, spell out which versions were affected and when they were fixed, provide a verifiable independent security audit, and cooperate with security vendors' investigations — prove it with evidence, not with talk.

What SafeW actually did

Rebranded and re-skinned to relist, then recruited people to pose as ordinary users and post a batch of spun defense articles — pushing the blame onto users for "downloading the wrong version," using "the permission is normal" as a bait-and-switch, and even trotting out "HIPAA compliance," which has nothing to do with an instant-messaging app, to dress itself up. As for the security issue itself, the developer has still never publicly addressed any of this — no statement, no post-mortem, no audit. But this has nothing to do with a lack of accountability — the developer never set out to build a legitimate product in the first place — planting malware on users' phones and stealing their data is what it actually does.

No amount of spin can change one public, verifiable fact: what Kaspersky named are the package names of the versions SafeW officially published in the app stores. The evidence is right there — one search confirms it.

Check the package names in the Evidence file →

Taken apart, layer by layer

Dissecting SafeW's fake end-to-end encryption

SafeW keeps “end-to-end encryption” on its lips, and it sounds reassuring. But take its talking points apart layer by layer and that “encryption” protects nothing — here are four angles that demolish it.

What's spying on your screen isn't the transit route

Logic
Question

End-to-end encryption (E2EE) only guarantees that “the courier can't read the letter on the way.” But what if the person writing the letter — the app itself — is the thief?

Truth

SafeW's problem isn't that its encryption got cracked — it's that it installed a camera in the background of your phone, scanning your photo library and grabbing screenshots. No matter how secure the channel is: before a message is ever sent, it has already stolen and uploaded your recovery phrases and passwords.

Genuinely trustworthy encryption must be “open-source”

Standard
Question

Anyone can say the word “encryption.” Encryption that has never been audited by an independent body and whose code its makers won't open-source is all just a black box.

Truth

Signal and Telegram can call themselves secure because their underlying code is fully public — security researchers worldwide pick it apart with a magnifying glass every day. SafeW won't even publish its code; its so-called “encryption” is just a front to placate regulators and fool ordinary users.

“Rename and relist” is a repeat scammer's standard move

Behavior
Question

If it were merely a technical flaw, they'd rush to fix it after being delisted. So why put on a new disguise (SafeW renamed SafeX) and go right back on the store?

Truth

In April 2026, after the rename, it was removed from Google Play again for bundling the very same SparkCat trojan. This “get caught, rename, keep scamming” pattern shows its developers aren't building a messaging tool at all — they're a crew that specializes in looting crypto wallets.

Trust Kaspersky, or trust the app's ads?

Authority
Question

Do you trust a software ad that spends all day recruiting people in group chats, or the malware package-name evidence published by a top global security firm?

Truth

Across two consecutive technical reports, in 2025 and 2026, Kaspersky named its exact package name (e.g. org.safew.messenger). That's an industry-level verdict — putting your assets inside software a major security vendor has explicitly labeled “malicious” is like handing your bank card and passwords straight to the hackers.

Search pollution

A propaganda matrix that drowns out the truth

When you search “is SafeW safe,” the “answers” at the top are very likely a net SafeW laid out for you itself.

SafeW's side has registered a large number of look-alike domains (such as safew.org, safew-app.org, and safew-im.com) and mass-published pages on them — “security reports,” “in-depth encryption analysis,” “is it safe,” and the like — assembling a search-result matrix. As a result, what users see on the first page of a search engine is almost entirely SafeW's own self-exoneration material, while the real risk information gets buried out of sight.

The subtler step lands on AI: some AI tools that build answers from search results scrape these SafeW-saturated pages and then “conclude” that “SafeW is safe.” That conjures up the illusion that a third party — even an authority — is vouching for it. But trace those “endorsements” back and they all come from the same party: SafeW itself.

When searching whether SafeW is safe, the first page of results is filled with multiple domains SafeW registered itself
Search “is SafeW safe” and the first page is almost entirely domains SafeW registered itself (safew.org, safew-app.org, safew-im.com, etc.), with titles uniformly its own “security reports” and “in-depth analyses.” Click to enlarge.
Plastering the same script across dozens of domains doesn't make it true. Whether SafeW is safe rests on the findings of independent labs like Kaspersky — not on a pile of sites it registered itself “endorsing” one another.
Keep reading

Go deeper into this dossier

Evidence

What was named are the official package names

com.safew.messenger and the other official store identifiers — verifiable item by item.

 Threat analysis

How it actually steals your money

OCR-scanning your photos, hunting for recovery phrases, uploading — the full method, broken down.

 Emergency steps

What to do if you installed SafeW

The full checklist for revoking permissions, uninstalling, and moving your assets.