Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Showing posts with label WhatsApp Security. Show all posts

Users Will Soon Text From External Apps Directly Inside WhatsApp

 


WhatsApp is taking a significant step towards ensuring greater digital openness across Europe by enabling seamless communication that extends beyond the borders of its own platform, making it closer to enabling seamless communication that extends beyond the confines of its platform itself. 

According to the requirements for interoperability outlined in the EU’s Digital Markets Act, the company is preparing to add third-party chat support to its chat services within the European Union. A new feature that is being offered by WhatsApp will allow users to communicate with users on other messaging services which are willing to integrate with the WhatsApp framework. This feature can be opted into by individuals who choose to opt in. 

An initial rollout, planned in Europe for both Android and iOS devices, will cover the basics like text, photos, videos, voice notes, and files, while a later phase will include a broader range of capabilities, including cross-platform group chats. 

The new system is offered as an option and can be controlled in the application's settings. However, WhatsApp's new features have been built in a way that ensures that end-to-end encryption standards are maintained within WhatsApp's existing security protocols, ensuring users' privacy is never compromised as a result of expanding connectivity. 

A few users in the European Union have reported a new "third-party chats" section in their WhatsApp account settings, which indicates that WhatsApp may be expanding its cross-platform ambitions. While this feature is still under development and has not yet been formally introduced, it gives a glimpse into how the platform intends to streamline communication across multiple platforms by making it easier to communicate. 

The Messenger app also offers users the option to sync their messages, photos, videos, voice messages, and documents with external apps, allowing them to exchange messages, photos, videos, voice notes, and documents with these apps or separate them into a separate section that is clearly identified and accessible to them.

It is important to note that some WhatsApp functions, including status posts, disappearing messages, and stickers, remain unsupported for the time being, and there are some limitations in place, such as the possibility of receiving messages from individuals previously blocked on WhatsApp who initiate contact through another platform. 

When users receive incoming message requests from third-party platforms, they can choose to respond immediately to messages or review them at their convenience according to how they want. In addition to providing a detailed preview of how the cross-platform experience will function once it has been released to a broader audience, WhatsApp’s testing phase will also give an in-depth look at how the cross-platform experience functions in real life. 

In parts of the European Union, Google is undergoing test trials regarding a new setting that exists within the app, known as "third-party chats," and allows users to exchange text messages, images, videos, voice notes, and documents with compatible external services through these third-party chats. In the beta period, BirdyChat seems to be the only app that is connected, but as more platforms adopt the required technical framework, there is expected to be a broader interoperability.

It is up to the user to decide whether to store these conversations in his or her primary inbox or separate folders based on his or her individual preferences. Some platform-specific tools, such as status updates, disappearing messages, and stickers, will not carry over to external exchanges, since they will only be accessible on WhatsApp. This feature is entirely optional, allowing those satisfied with WhatsApp's existing environment to leave it disabled. Further, WhatsApp blocked users are still able to reach out to those blocked via a third-party application, which the company has noted in its testing. 

Although WhatsApp's own communication channels continue to be encrypted end-to-end, the level of protection for messages that are exchanged with other platforms is a result of the encryption policies adopted by those services. The company maintains that it cannot read the content of chats sent by third parties, even when they are accessed through WhatsApp' interface. 

Despite months of controlled testing, what has been done to highlight the progress made through the cross-platform initiative is now moving into a broader rollout phase. As part of a recent announcement by the company, we learned that WhatsApp users in the European region will shortly be able to communicate directly with people using BirdyChat and Haiket by using the newly introduced third-party chat feature. 

Meta describes this advance as a key milestone that will help Meta meet the EU's requirements for interoperability under the Digital Markets Act of the European Union. The new feature will enable European users to send messages, images, voice notes, videos, and files via external platforms to their external contacts and as soon as partner services complete their own technical preparations, users will be able to exchange group messages and images with each other. 

A notification will appear in the Settings tab to guide users through the opt-in process as Meta plans to enter this feature gradually over the coming weeks. Currently, the feature is only compatible with Android and iOS, leaving desktop, web, and tablet versions of the app unaffected. 

As Meta points out, these partnerships were developed over the course of several years as a result of repeated efforts by European messaging providers and the European Commission to establish an interoperability framework that is both DMA-compliant and protects the privacy of users. It is mandatory for all third-party interactions to follow encryption protocols, which are consistent with WhatsApp's own end-to-end protections. 

Furthermore, the interface has been designed to make it easy for users to distinguish between native and external chats. The system was already previewed by Meta in late 2024, which included features like a dedicated folder for third-party messages and an alert system when a new external messaging service becomes available for use. In accordance with the Digital Markets Act, WhatsApp is under pressure to support only the most basic messaging functionality. 

However, WhatsApp is in the process of developing advanced features for third-party chat users who enable the function. A number of advanced interaction features will accompany the initial rollout of Meta's communication services, such as message reaction, threaded replies, typing indicator, and read receipts, ensuring a smoother and more familiar communication process across multiple services.

There is also a long-term roadmap that has been developed by the company, which includes the introduction of cross-platform group chats in 2025, as well as the implementation of voice and video calling by 2027, once technical integrations have matured. 

Aside from the fact that WhatsApp emphasizes that the wider availability of these features depends on how soon other messaging apps will embrace the necessary standards for interoperability, the company believes the ultimate goal is to create an intuitive, secure platform that allows users to seamlessly communicate across multiple platforms with ease and without any hassle.

A feature like the one listed above, as WhatsApp moves steadily towards a more integrated messaging ecosystem, will likely have a long-term impact that extends beyond the convenience it provides. As WhatsApp opens its doors to external platforms, it is positioning itself at the center of a unified digital communication landscape—one in which users will not have to juggle a variety of applications in order to remain in touch.

The shift provides consumers with greater flexibility, a wider reach, and fewer barriers between services, while for developers it creates a new competitive environment based on interoperability rather than isolation. It is quite likely that, if this transition is executed well, it will redefine how millions of people around the world navigate their daily lives.

Screen Sharing on WhatsApp Turns Costly with Major Financial Loss

 


Several disturbing patterns of digital deception have quietly developed in recent months, revealing just how readily everyday communications tools can be turned into instruments of financial ruin in an instant. According to security researchers, there has been an increase in sophisticated cybercriminal schemes utilizing the trust users place in familiar platforms, particularly WhatsApp, to gain access to the internet. 

It is a common occurrence that what initially starts out as a friendly message, an unexpected image, or a polite call claiming that an “urgent issue” with a bank account is a crafted scam which soon unravels into a meticulously crafted scam. It is very possible for malicious software to be installed through downloading an innocuous-looking picture that can allow you to infiltrate banking applications, harvest passwords, and expose personal identification information without your knowledge. 

There have been instances where fraudsters impersonating bank representatives have coaxed users into sharing their screens with the false pretense that they are resolving account discrepancy. When this has happened, these fraudsters can observe every detail in real time - OTP codes, login credentials, account balances - and in some cases, they will convince victims to install remote access programs or screen mirroring programs so they can further control the device. 

It is evident from the intertwined tactics that a troubling trend in digital crime has taken place, emphasizing the need for increased vigilance among Indians and beyond, underscoring a troubling development. There is a fast-growing network of social-engineering groups operating across multiple regions, who are utilizing WhatsApp's screen-sharing capabilities to bypass safety measures and gain control of their financial lives by manipulating their screen-sharing capabilities. 

Investigators have begun piecing together the contours of this network. Initially introduced in 2023 as a convenience feature, screen-sharing has since become a critical point of exploitation for fraudsters who place unsolicited video calls, pretend to be bank officials or service providers, and convince victims to reveal their screens, or install remote-access applications masquerading as diagnostic tools, to exploit their vulnerabilities. 

Almost $700,000 was defrauded by one victim in one of the cases of abuse that spanned from India and the U.K. to Brazil and Hong Kong. This demonstrates how swiftly and precisely these schemes emerge. In describing the technique, it is noted that it is not based on sophisticated malware, but rather on urgency, trust, and psychological manipulation, allowing scammers to circumvent a lot of traditional technical protections. 

Furthermore, criminal networks are enhancing their arsenals by spreading malicious files via WhatsApp Web, including one Brazilian operation that uses self-replicating payloads to hijack contacts, automate fraudulent outreach, and compromise online banking credentials through its use of malicious payloads distributed through WhatsApp Web. 

The investigators of the fraud note that the mechanisms are based less on technical sophistication and more on psychological pressure intended to disarm victims. An unsolicited WhatsApp video call made by a number that appears local can be the start of the scam, usually presented as a bank officer, customer service agent, or even an acquaintance in need of assistance. 

Callers claim to have an urgent problem to solve - an unauthorized transaction, an account suspension threat, or even an error in the verification process - that creates a feeling of panic that encourages their victims to comply without hesitation.

The imposter will initially convince the victim that the issue is being resolved, thereby leading to them sharing their screen or installing a legitimate remote-access application, such as AnyDesk or TeamViewer, which will enable the fraudster to watch every action that occurs on the screen in real time, as they pretend to resolve it. 

By using this live feed, an attacker can access one-time passwords, authentication prompts, banking app interfaces, as well as other sensitive credentials. By doing so, attackers can be able to take control of WhatsApp accounts, initiate unauthorized transfers, or coax the victim into carrying out these actions on their own.

A more elaborate variant consists of guiding the victim into downloading applications that secretly contain keyloggers or spyware that can collect passwords and financial information long after the call has ended, allowing them to collect it all. When scammers have access to personal information such as banking details or social media profiles, they can drain accounts, take over accounts on social networks, and assume the identity of victims to target others on their contact list.

Authorities caution that the success of these schemes depends on trust exploiting, so user vigilance is key. According to the advisories, individuals should be cautious when receiving unknown phone calls, avoid sharing screens with unknown parties, disable installations coming from untrusted sources, and refrain from opening financial apps when they are receiving remote access. 

These measures are crucial in order to prevent these social engineering scams from getting the better of them, as they continue to develop. As far as the most advanced variations of the scam are concerned, the most sophisticated versions of the scam entail criminals installing malicious software through deceptive links or media files in a victim's device, thus granting them complete control of that victim's computer. 

When these kinds of malware are installed, they can record keystrokes, capture screens, gather banking credentials, intercept two-factor authentication codes, and even gain access to sensitive identity documents. It is possible for attackers to take control of cameras and microphones remotely, which allows them to utilize the device as a tool for surveillance, coercion, or a long-term digital impersonation device. 

In addition to financial theft, the extent to which the compromised identity may be exploited goes far beyond immediate financial exploitation, often enabling blackmail and continuous abuse of the victim's identity. 

In light of this backdrop, cybersecurity agencies emphasize the significance of adopting preventative habits that can significantly reduce exposure to cybercriminals. There is still an important role to play in ensuring that users do not download unfamiliar media, disable WhatsApp's automatic download feature, and keep reputable mobile security tools up to date. 

WhatsApp still has the built-in features that allow them to block and report suspicious contacts, while officials urge individuals to spread basic cyber-hygiene knowledge among their communities, pointing out that many people fall victim to cyber-attacks simply because they lack awareness of the dangers that lurk. 

There has been a surge of fraud attempts across messaging platforms, and Indian authorities, including the Indian Cybercrime Coordination Centre, as well as various state cyber cells have issued a number of public advisories about this, and citizens are encouraged to report such attacks to the National Cybercrime Reporting Portal as soon as possible. 

In conjunction with these warnings, these findings shed light on a broader point: even the most ordinary digital interactions are capable of masking sophisticated threats, and sustained vigilance remains the strongest defense against the growing epidemic of social engineering and malware-driven crimes that are booming in modern society. 

As the majority of the fraud is carried out by social-engineering tactics, researchers have also observed a parallel wave of malware campaigns that are utilizing WhatsApp's broader ecosystem, which demonstrates how WhatsApp is capable of serving as a powerful channel for large-scale infection. As an example of self-replicating chains delivered through WhatsApp Web, one of the most striking cases was reported by analysts in Brazil. 

A ZIP archive was sent to the victims, which when opened, triggered the obfuscated VBS installer SORVEPOTEL, which was an obfuscated VBS installer. In this PowerShell routine, the malware used ChromeDriver and Selenium to re-enter the victim's active WhatsApp Web session, enabling the malware to take full control of the victim's active WhatsApp Web session. 

In order to spread the malware, the script retrieved message templates from a command-and-control server, exfiltrated the user's contact list, and automatically distributed the same malicious ZIP file to every network member that was connected with it—often while displaying a fake banner that said "WhatsApp Automation v6.0" to give it the appearance of legitimacy. 

Researchers found that Maverick was a payload that was evasive and highly targeted, and it was also accompanied by a suite of malicious capabilities. It was also packaged inside the ZIP with a Windows LNK file that could execute additional code through the use of a remote server that had the first stage loader on it. As soon as the malware discovered that the device was belonging to a Brazilian user, it launched its banking module only after checking for debugging tools, examining the system locale indicators such as the time zone and language settings. 

A Maverick server monitoring website activity for URLs linked to Latin American financial institutions, when activated, was aligned with credential harvesting and account manipulation against regional banks, aligning its behavior with credential harvesting. As Trend Micro pointed out previously, an account ban could be issued as a result of the sheer volume of outbound messages caused by a similar WhatsApp Web abuse vector, which relied on active sessions to mass-distribute infected ZIP files. 

These malware infections acted primarily as infostealers that targeted Brazilian banking and cryptocurrency platforms, thereby demonstrating the fact that financial fraud objectives can be easily mapped to WhatsApp-based lures when it comes to financial fraud. 

It is important to note, however, that security analysts emphasize that the global screen-sharing scams are not primarily the work of a single sophisticated actor, but rather the work of a diffuse criminal ecosystem that combines trust, urgency, and social manipulation to make them successful. According to ESET researchers, these tactics are fundamentally human-driven rather than based on technical exploits over a long period of time, whereas Brazilian malware operations show clearer signs of being involved in structured criminal activity. 

It is thought that the Maverick Trojan can be linked to the group that has been named Water Saci, whose operations overlap with those of the Coyote banking malware family-which indicates that these groups have been sharing techniques and developing tools within Brazil's underground cybercrime market. 

Even though the associations that have been drawn between WhatsApp and opportunistic scammers still seem to be rooted in moderate confidence, they reveal an evolving threat landscape in which both opportunistic scammers and organized cybercriminals work towards exploiting WhatsApp to their advantage. 

A number of analysts have indicated that the success of the scheme is a function of a carefully orchestrated combination of trust, urgency, and control. By presenting themselves as legitimate entities through video calls that appear to originate from banks, service providers, or other reliable entities, scammers achieve a veneer of legitimacy by appearing authentic.

In addition, they will fabricate a crisis – a fake transaction, a compromised account, or a suspended service – in order to pressure the victim into making a hasty decision. The last step is perhaps the most consequential: convincing the victim to share their screen with the attacker, or installing a remote access tool, which in effect grants the attacker complete access to the device. 

In the event that a phone is gained access to, then every action, notification, and security prompt becomes visible, revealing the phone as an open book that needs to be monitored. Security professionals indicate that preventative measures depend more on vigilance and personal precautions than on technical measures alone. 

Unsolicited calls should be treated with suspicion, particularly those requesting sensitive information or screen access, as soon as they are received, and any alarming claims should be independently verified through official channels before responding to anything unfounded. The use of passwords, OTPs, and banking information should never be disclosed over the telephone or through email, as legitimate institutions would not request such data in this manner. 

Installing remote access apps at the direction of unfamiliar callers should be avoided at all costs, given that remote access applications allow you to control your device completely. It is also recommended to enable WhatsApp's built-in two-step verification feature, which increases the security level even in the event of compromised credentials.

Finally, investigators emphasize that a healthy degree of skepticism remains the most effective defense; if we just pause and check it out independently, we may be able to prevent the cascading damage that these highly persuasive scams intend to cause us.

Critical WhatsApp Zero Click Vulnerability Abused with DNG Payload

 


It has been reported that attackers are actively exploiting a recently discovered vulnerability in WhatsApp's iOS application as a part of a sophisticated cyber campaign that underscores how zero-day vulnerabilities are becoming weaponised in today's cyber warfare. With the zero-click exploit identified as CVE-2025-55177 with a CVSS score of 5.4, malicious actors can execute unauthorised content processing based on any URL on a victim's device without the need for user interaction whatsoever. 

A vulnerability referred to as CVE-2025-55177 provides threat actors with a way to manipulate WhatsApp's synchronization process, so they may force WhatsApp to process attacker-controlled content during device linking when they manipulate the WhatsApp synchronization process. 

Even though the vulnerability could have allowed crafted content to be injected or disrupted services, its real danger arose when it was combined with Apple's CVE-2025-43300, another security flaw that affects the ImageIO framework, which parses image files. In addition to this, there were also two other vulnerabilities in iOS and Mac OS that allowed out-of-bounds memory writing, which resulted in remote code execution across these systems. 

The combination of these weaknesses created a very powerful exploit chain that could deliver malicious images through the incoming message of a WhatsApp message, causing infection without the victim ever having to click, tap or interact with anything at all—a quintessential zero-click attack scenario. Investigators found that the targeting of the victims was intentional and highly selective. 

In the past, WhatsApp has confirmed that it has notified fewer than 200 people about potential threats in its apps, a number that is similar to earlier mercenary spyware operations targeting high-value users. Apple has also acknowledged active exploitation in the wild and has issued security advisories concurrently. 

Researchers from Amnesty International noted that, despite initial signs suggesting limited probing of Android devices, this campaign was mainly concerned with Apple's iOS and macOS ecosystems, and therefore was focused on those two ecosystems mainly. The implications are particularly severe for businesses.

Corporate executives, legal teams, and employees with privileged access to confidential intellectual property are at risk of being spied on or exfiltrated through using WhatsApp on their work devices, which represents a direct and potentially invisible entry point into corporate data systems. 

Cybersecurity and Infrastructure Security Agency (CISA) officials say that the vulnerability was caused by an "incomplete authorisation of linked device synchronisation messages" that existed in WhatsApp for iOS versions before version 2.25.2.173, WhatsApp Business for iOS versions of 2.25.1.78, and WhatsApp for Mac versions of 2.25.21.78. 

This flaw is believed to have been exploited by researchers as part of a complex exploit chain, which was created using the flaw in conjunction with a previously patched iOS vulnerability known as CVE-2025-43300, allowing for the delivery of spyware onto targeted devices. A U.S. government advisory has been issued urging federal employees to update their Apple devices immediately because the campaign has reportedly affected approximately 200 people. 

A new discovery adds to the growing body of evidence that advanced cyber threat actors increasingly rely on chaining multiple zero-day exploits to circumvent hardened defences and compromise remote devices. In 2024, Google's Threat Analysis Group reported 75 zero-day exploits that were actively exploited, a figure that reflects how the scale of these attacks is accelerating. 

This stealthy intrusion method continues to dominate as the year 2025 unfolds, resulting in nearly one-third of all recorded compromise attempts worldwide occurring this year. It is important for cybersecurity experts to remind us that the WhatsApp incident demonstrates once more the fragility of digital trust, even when it comes to encrypting platforms once considered to be secure. 

It has been uncovered that the attackers exploited a subtle logic flaw in WhatsApp’s device-linking system, allowing them to disguise malicious content to appear as if it was originating from the user’s own paired device, according to a technical analysis.

Through this vulnerability, a specially crafted Digital Negative (DNG) file could be delivered, which, once processed automatically by the application, could cause a series of memory corruption events that would result in remote code execution. Researchers at DarkNavyOrg have demonstrated the proof-of-concept in its fullest sense, showing how an automated script is capable of authenticating, generating the malicious DNG payload, and sending it to the intended victim without triggering any security alerts. 

In order to take advantage of the exploit, there are no visible warnings, notification pop-ups, or message notifications displayed on the user's screen. This allows attackers to gain access to messages, media, microphones, and cameras unrestrictedly, and even install spyware undetected. It has been reported to WhatsApp and Apple that the vulnerability has been found, and patches have been released to mitigate the risks. 

Despite this, security experts recommend that users install the latest updates immediately and be cautious when using unsolicited media files—even those seemingly sent by trusted contacts. In the meantime, organisations should ensure that endpoint monitoring is strengthened, that mobile device management controls are enforced, and that anomalous messaging behaviour is closely tracked until the remediation has been completed. 

There is a clear need for robust input validation, secure file handling protocols, and timely security updates to prevent silent but highly destructive attacks targeting mainstream communication platforms that can be carried out against mainstream communication platforms due to the incident. Cyber adversaries have, for a long time, been targeting companies such as WhatsApp, and WhatsApp is no exception. 

It is noteworthy that despite the platform's strong security framework and end-to-end encryption, threat actors are still hunting for new vulnerabilities to exploit. Although there are several different cyberattack types, security experts emphasise that zero-click exploits remain the most insidious, since they can compromise devices without the user having to do anything. 

V4WEB Cybersecurity founder, Riteh Bhatia, made an explanation for V4WEB's recent WhatsApp advisory, explaining that it pertains to one of these zero-click exploits--a method of attacking that does not require a victim to click, download, or applaud during the attack. Bhatia explained that, unlike phishing, where a user is required to click on a malicious link, zero-click attacks operate silently, working in the background. 

According to Bhatia, the attackers used a vulnerability in WhatsApp as well as a vulnerability in Apple's iOS to hack into targeted devices through a chain of vulnerabilities. He explained to Entrepreneur India that this process is known as chaining vulnerabilities. 

Chaining vulnerabilities allows one weakness to provide entry while the other provides control of the system as a whole. Further, Bharatia stressed that spyware deployed by these methods is capable of doing a wide range of invasive functions, such as reading messages, listening through the microphone, tracking location, and accessing the camera in real time, in addition to other invasive actions. 

As a warning sign, users might notice excessive battery drain, overheating, unusual data usage, or unexpected system crashes, all of which may indicate that the user's system is not performing optimally. Likewise, Anirudh Batra, a senior security researcher at CloudSEK, stated that zero-click vulnerabilities represent the "holy grail" for hackers, as they can be exploited seamlessly even on fully updated and ostensibly secure devices without any intervention from the target, and no action is necessary on their part.

If this vulnerability is exploited effectively, attackers will be able to have full control over the targeted devices, which will allow them to access sensitive data, monitor communications, and deploy additional malware, all without the appearance of any ill effect. As a result of this incident, it emphasises that security risks associated with complex file formats and cross-platform messaging apps persist, since flaws in file parsers continue to serve as common pathways for remote code execution.

There is a continuing investigation going on by DarkNavyOrg, including one looking into a Samsung vulnerability (CVE-2025-21043), which has been identified as a potential security concern. There was a warning from both WhatsApp and Apple that users should update their operating systems and applications immediately, and Meta confirmed that less than 200 users were notified of in-app threats. 

It has been reported that some journalists, activists, and other public figures have been targeted. Meta's spokesperson Emily Westcott stressed how important it is for users to keep their devices current and to enable WhatsApp's privacy and security features. Furthermore, Amnesty International has also noted possible Android infections and is currently conducting further investigation. 

In the past, similar spyware operations occurred, such as WhatsApp's lawsuit against Israel's NSO Group in 2019, which allegedly targeted 1,400 users with the Pegasus spyware, which later became famous for its role in global cyberespionage. While sanctions and international scrutiny have been applied to such surveillance operations, they continue to evolve, reflecting the persistent threat that advanced mobile exploits continue to pose. 

There is no doubt that the latest revelations are highlighting the need for individuals and organisations to prioritise proactive cyber security measures rather than reactive ones, as zero-click exploits are becoming more sophisticated, the traditional boundaries of digital security—once relying solely on the caution of users—are eroding rapidly. It has become increasingly important for organisations to keep constant vigilance, update their software quickly, and employ layered defence strategies to protect both their personal and business information. 

Organisations need to invest in threat intelligence solutions, continuous monitoring systems, and regular mobile security audits if they want to be on the lookout for potential threats early on. In order for individual users to reduce their exposure, they need to maintain the latest version of their devices and applications, enable built-in privacy protections, and avoid unnecessary third-party integrations. 

The WhatsApp exploit is an important reminder that even trusted, encrypted platforms may be compromised at some point. The cyber espionage industry is evolving into a silent and targeted operation, and digital trust must be reinforced through transparent processes, rapid patching, and global cooperation between tech companies and regulators. A strong defence against invisible intrusions still resides in awareness and timely action.