Loading story…
WhatsApp has announced the rollout of passkey-encrypted chat backups for both iOS and Android devices, allowing users to secure their stored message history using biometric authentication methods such as fingerprint, face recognition, or device screen-lock codes. This new feature leverages passwordless authentication standards like FIDO2/WebAuthn, replacing traditional backup passwords with cryptographic keys stored securely on the user's device. The update aims to simplify the backup security model and reduce risks associated with weak or forgotten passwords, as the device's biometric or lock code now serves as the primary gatekeeper for backup access.
The introduction of passkey-encrypted backups reflects a broader industry shift toward passwordless authentication, with passkeys gaining traction among users seeking enhanced security and convenience. WhatsApp users can enable this feature by navigating to Settings > Chats > Chat backup > End-to-end encrypted backup, and the rollout is expected to reach all users over the coming months. This move builds on WhatsApp's previous implementation of end-to-end encrypted chat backups and further strengthens the privacy and security of user data stored on cloud services like iCloud and Google Drive.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
WhatsApp introduced support for securing chat backups with passkeys on iOS and Android, enabling passwordless protection for backup access. The feature was publicly reported as available on October 30, 2025.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Meta’s WhatsApp is developing an **optional account password** feature for Android that adds a new authentication step on top of the existing registration flow, according to references found in *WhatsApp Beta for Android* `2.26.7.8` distributed via the Google Play Beta Program. The feature would let users set an alphanumeric password **6–20 characters** long, requiring at least **one letter and one number**, with in-app guidance on password strength; users would be able to **change or remove** the password at any time. The password is intended to reduce **account takeover** risk in scenarios such as **SIM swapping**, intercepted verification codes, or compromised devices. During login, WhatsApp would prompt for the password **after** the 6-digit SMS verification code; if **two-step verification (PIN-based 2FA)** is also enabled, the user would enter the 2FA code and then the account password. The work builds on WhatsApp’s existing optional protections, including two-step verification and account recovery via a registered email address.
Jun 29, 2026
WhatsApp announced a new optional security mode, **“Strict Account Settings,”** designed to reduce exposure to *highly sophisticated attacks*—particularly **mercenary spyware**—by limiting risky functionality when enabled. The feature is expected to roll out in the coming weeks and includes restrictions such as blocking attachments and media from people not in a user’s contact list; it can be enabled via `Settings > Privacy > Advanced`. WhatsApp positioned the change as an additional layer beyond default **end-to-end encryption**, aimed at higher-risk users such as journalists and public-facing figures, and noted its ongoing legal fight with **NSO Group** over the 2019 Pegasus campaign that targeted roughly 1,400 WhatsApp users. The approach mirrors Apple’s **Lockdown Mode**, which similarly reduces attack surface for a small subset of users who may be personally targeted by advanced threats by disabling or constraining features across core services. Apple documents that Lockdown Mode blocks most message attachment types, limits complex web technologies, restricts incoming FaceTime calls to recent contacts, blocks certain Apple service invitations, and removes some photo-sharing metadata—trading usability for stronger protection against targeted exploitation. Together, the updates reflect a broader industry pattern of offering *opt-in, high-friction hardening modes* to mitigate spyware and other highly targeted intrusion techniques.
Jun 29, 2026
Microsoft said it is phasing out SMS-based authentication and account recovery for personal Microsoft accounts, citing fraud, phishing, SIM-swapping, and delivery delays as key reasons for the change. Updated support guidance says users will be moved toward passwordless sign-in with **passkeys** and **verified secondary email addresses**, reflecting a broader industry retreat from SMS as a security control. The company has begun rolling out a redesigned sign-in experience that encourages users to choose a **"sign in faster"** option and create a passkey backed by device biometrics or a PIN. Microsoft said passkeys can be stored on devices, in password managers, or through Windows Hello-compatible hardware across Windows 11, Android, iOS, and macOS, but it has not given a final cutoff date for SMS, meaning users who still rely on texted codes will need to set up a passkey or verified backup email before the transition is completed.
Jun 29, 2026