Loading story…
Security researchers and intelligence analysts have documented a series of incidents and trends highlighting the risks to mobile messaging accounts and devices. In December, a new form of WhatsApp account hijacking called GhostPairing was identified, where attackers trick users into linking an attacker-controlled browser to their WhatsApp device, potentially exposing sensitive information. Separately, researchers uncovered large-scale scraping of WhatsApp's contact discovery tool, resulting in the exposure of billions of phone numbers and associated profile data. Meanwhile, spyware threats targeting both iPhone and Android users have escalated, with zero-click attacks enabling adversaries to compromise devices and access encrypted messaging apps such as WhatsApp and Signal. Apple and Google responded by patching vulnerabilities believed to be exploited by commercial spyware like Predator, and the US CISA issued warnings about the active targeting of mobile messaging applications.
In another high-profile case, the Iranian-linked Handala hacking group claimed to have fully compromised the mobile devices of two Israeli officials. However, forensic analysis revealed that only their Telegram accounts were breached, not the entire devices. The attackers likely used techniques such as SIM swapping, SS7 exploitation, and phishing to gain access, exposing gaps in session management and account security on encrypted messaging platforms. These incidents underscore the growing sophistication of attacks against mobile messaging services and the need for robust security measures, including privacy controls, passkey-encrypted backups, and vigilance against phishing and SIM-based attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A recent attack dubbed GhostPairing tricked users into linking an attacker's browser session to their WhatsApp account, enabling account access through social engineering. The technique demonstrated that users can still be compromised even without breaking WhatsApp's encryption.
Austrian researchers reported a large-scale scraping operation that abused WhatsApp's contact discovery feature to collect phone numbers and profile data. The incident highlighted privacy risks on the platform despite its end-to-end encryption protections.
Kela cyber intelligence determined that Handala's claimed device compromises were instead limited to Telegram account takeovers, likely achieved through methods such as SIM swapping, SS7 abuse, phishing, or session hijacking. The firm's forensic review found the leaked data matched active Telegram account information, clarifying the true scope of the breach.
In December 2025, hundreds of iPhone and Android users received official warnings about targeted spyware attacks. Apple and Google responded by quickly patching the related security vulnerabilities tied to the campaign.
In December 2025, Handala claimed it had fully compromised the mobile devices of two prominent Israeli political figures. Subsequent analysis indicated the attackers actually gained access to the victims' Telegram accounts and extracted contact lists, media, and chat data.
The hacking group Handala has been active since December 2023, publicly supporting Iran and Palestinian causes while targeting Israeli organizations and individuals. Its activity was promoted on cybercrime forums and social media, suggesting a sustained campaign rather than an isolated incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
wired.com
Open sourcewired.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A recently discovered vulnerability in WhatsApp allowed researchers to enumerate up to 3.5 billion active accounts by exploiting the app's contact syncing feature. This flaw, responsibly disclosed by researchers at the University of Vienna and subsequently patched by Meta, could have enabled malicious actors to build massive databases of phone numbers linked to WhatsApp, along with associated profile photos and "About" texts. While there is no evidence the vulnerability was exploited in the wild, the incident highlights the risks posed by convenience features and the critical importance of protecting phone numbers as sensitive personal data. In addition to this privacy risk, WhatsApp users are being targeted by a new Android malware that propagates itself through the platform. The malware automatically replies to incoming WhatsApp messages with malicious links, leveraging the trust users place in their contacts to spread further. This attack exploits the phenomenon of "context collapse," where users' social boundaries blur on messaging platforms, making them more susceptible to social engineering. These developments underscore the growing threat landscape facing WhatsApp users, combining both technical vulnerabilities and sophisticated social attacks.
Jun 29, 2026
Cybercriminals are increasingly leveraging built-in features of popular mobile platforms to execute sophisticated social engineering scams aimed at stealing sensitive credentials and financial assets. On WhatsApp, scammers exploit the screen-sharing function by impersonating trusted entities such as bank employees or support agents, coercing victims into sharing their screens under the pretense of resolving urgent security issues. This access enables attackers to view and capture one-time passwords (OTPs), banking details, and other personal information, resulting in significant financial losses. In response, Meta has introduced AI-powered safety tools, including real-time warnings when users attempt to share their screens with unknown contacts, to mitigate these attacks. Similarly, iPhone users are being targeted through phishing campaigns that exploit the "Find My" feature. After a device is lost or stolen, scammers send convincing fake messages—purportedly from Apple Support—containing links that claim to help locate the missing phone. By leveraging accurate device details and the victim's sense of urgency, attackers trick users into divulging their Apple ID credentials, potentially granting full access to personal data and accounts. Authorities such as Switzerland’s National Cyber Security Centre have issued warnings about these tactics, emphasizing the need for heightened vigilance when responding to unsolicited messages related to lost devices.
Jun 29, 2026
A social-engineering technique dubbed **GhostPairing** is being used to hijack WhatsApp accounts by abusing the app’s legitimate **Linked Devices** feature rather than stealing passwords or one-time codes. Attackers reportedly trick victims into approving an attacker-controlled companion device through deceptive QR codes, fake support interactions, messages, or other pretexts, giving criminals persistent access to chats while the victim may remain unaware. Once a rogue device is linked, attackers can read messages, monitor conversations, impersonate the victim, and use the trusted account for payment fraud, phishing, identity abuse, invoice scams, and executive impersonation targeting business partners. Researchers said the tactic reflects a broader criminal shift toward abusing trusted digital workflows, and recommended that users review WhatsApp linked sessions, remove unknown devices, enable **two-step verification**, secure phones with screen locks, and independently verify urgent or unusual requests.
Jul 16, 2026