Loading story…
WhatsApp announced a new optional security mode, “Strict Account Settings,” designed to reduce exposure to highly sophisticated attacks—particularly mercenary spyware—by limiting risky functionality when enabled. The feature is expected to roll out in the coming weeks and includes restrictions such as blocking attachments and media from people not in a user’s contact list; it can be enabled via Settings > Privacy > Advanced. WhatsApp positioned the change as an additional layer beyond default end-to-end encryption, aimed at higher-risk users such as journalists and public-facing figures, and noted its ongoing legal fight with NSO Group over the 2019 Pegasus campaign that targeted roughly 1,400 WhatsApp users.
The approach mirrors Apple’s Lockdown Mode, which similarly reduces attack surface for a small subset of users who may be personally targeted by advanced threats by disabling or constraining features across core services. Apple documents that Lockdown Mode blocks most message attachment types, limits complex web technologies, restricts incoming FaceTime calls to recent contacts, blocks certain Apple service invitations, and removes some photo-sharing metadata—trading usability for stronger protection against targeted exploitation. Together, the updates reflect a broader industry pattern of offering opt-in, high-friction hardening modes to mitigate spyware and other highly targeted intrusion techniques.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Alongside the Strict Account Settings announcement, Meta said it is adopting Rust in WhatsApp's media-sharing and media-validation components to reduce memory-safety risks from malicious files and spyware. The company described this as part of a broader defense-in-depth strategy that also includes hardening existing C/C++ code.
Meta announced WhatsApp's new Strict Account Settings in late January 2026 as a lockdown-style security feature for high-risk users such as journalists, activists, and public figures. The feature applies restrictive privacy and security controls, including limiting or blocking interactions from unknown contacts, and is set to roll out gradually over the coming weeks.
In December 2025, a federal judge ruled that NSO Group can never again use WhatsApp infrastructure for spyware attacks, according to WhatsApp's description of the case. NSO Group has contested the injunction and argued it could bankrupt the company.
Apple introduced Lockdown Mode in July 2022 as an optional extreme-protection feature for people who may be personally targeted by highly sophisticated digital threats such as mercenary spyware. The mode reduces device attack surface by restricting functionality across apps, web technologies, calls, invitations, and device connections.
In 2019, roughly 1,400 WhatsApp users were reportedly targeted using NSO Group's zero-click Pegasus spyware through WhatsApp infrastructure. The incident became a key reference point for later WhatsApp anti-spyware protections and litigation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcetechrepublic.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcetherecord.media
Open sourcecyberscoop.com
Open sourcesupport.apple.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple said it has not observed any successful mercenary spyware compromises on devices with **Lockdown Mode** enabled, nearly four years after launching the opt-in protection for users at elevated risk of targeted surveillance. Introduced in 2022, the feature hardens iPhones and other Apple devices by disabling or restricting functions that have repeatedly been abused in spyware campaigns, particularly the remotely reachable components used in **zero-click** exploit chains. Independent findings cited by Apple support the claim. Researchers at **Amnesty International** and **Citizen Lab** said they have not seen evidence of successful infections on Lockdown Mode-enabled iPhones, and Citizen Lab documented cases in which the feature blocked **Pegasus** and **Predator** spyware attacks. Google researchers also reported at least one spyware campaign that abandoned infection attempts after detecting Lockdown Mode, while security researcher Patrick Wardle said the feature’s aggressive reduction of attack surface makes it especially effective against exploit delivery methods used by mercenary spyware operators.
Jun 29, 2026
Discussion focused on whether stronger *platform-level restrictions* are necessary to curb mobile threats, contrasting Android’s openness with iOS’s “lockdown” approach. One thread highlights Google’s plan to require centralized **developer registration/verification** for apps installed on Android-certified devices (even if distributed outside Google Play), framed as a way to reduce malware and prevent repeat offenders from re-signing and redistributing blocked apps; it also notes Android’s recent mitigations such as **Restricted Settings** (Android 14) and **Enhanced Confirmation Mode** (Android 15) as partial technical barriers against common scam/phishing tactics. Separately, iOS **Lockdown Mode** is presented as an extreme, reversible hardening option intended for high-risk users (e.g., journalists, activists) that reduces attack surface by disabling or restricting features (e.g., most message attachments/link previews, certain web technologies, incoming FaceTime from unknowns, accessory connections while locked, non-secure Wi‑Fi, and installation of device management profiles). The article cites reporting that a seized journalist phone could not be accessed using law-enforcement forensic tooling when Lockdown Mode was enabled, underscoring how aggressive feature reduction can materially impede both targeted exploitation and post-seizure forensic access.
Jun 29, 2026
Security researchers and intelligence analysts have documented a series of incidents and trends highlighting the risks to mobile messaging accounts and devices. In December, a new form of WhatsApp account hijacking called GhostPairing was identified, where attackers trick users into linking an attacker-controlled browser to their WhatsApp device, potentially exposing sensitive information. Separately, researchers uncovered large-scale scraping of WhatsApp's contact discovery tool, resulting in the exposure of billions of phone numbers and associated profile data. Meanwhile, spyware threats targeting both iPhone and Android users have escalated, with zero-click attacks enabling adversaries to compromise devices and access encrypted messaging apps such as WhatsApp and Signal. Apple and Google responded by patching vulnerabilities believed to be exploited by commercial spyware like Predator, and the US CISA issued warnings about the active targeting of mobile messaging applications. In another high-profile case, the Iranian-linked Handala hacking group claimed to have fully compromised the mobile devices of two Israeli officials. However, forensic analysis revealed that only their Telegram accounts were breached, not the entire devices. The attackers likely used techniques such as SIM swapping, SS7 exploitation, and phishing to gain access, exposing gaps in session management and account security on encrypted messaging platforms. These incidents underscore the growing sophistication of attacks against mobile messaging services and the need for robust security measures, including privacy controls, passkey-encrypted backups, and vigilance against phishing and SIM-based attacks.
Jun 29, 2026