Loading story…
Meta’s WhatsApp is developing an optional account password feature for Android that adds a new authentication step on top of the existing registration flow, according to references found in WhatsApp Beta for Android 2.26.7.8 distributed via the Google Play Beta Program. The feature would let users set an alphanumeric password 6–20 characters long, requiring at least one letter and one number, with in-app guidance on password strength; users would be able to change or remove the password at any time.
The password is intended to reduce account takeover risk in scenarios such as SIM swapping, intercepted verification codes, or compromised devices. During login, WhatsApp would prompt for the password after the 6-digit SMS verification code; if two-step verification (PIN-based 2FA) is also enabled, the user would enter the 2FA code and then the account password. The work builds on WhatsApp’s existing optional protections, including two-step verification and account recovery via a registered email address.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Meta released WhatsApp Beta for Android 2.26.7.8 through the Google Play Beta Program, and the build contained references to a forthcoming optional account password feature. The feature is designed to add an extra login credential beyond the SMS verification code and existing two-step verification to help prevent account takeovers such as SIM swapping or device compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WhatsApp has announced the rollout of passkey-encrypted chat backups for both iOS and Android devices, allowing users to secure their stored message history using biometric authentication methods such as fingerprint, face recognition, or device screen-lock codes. This new feature leverages passwordless authentication standards like FIDO2/WebAuthn, replacing traditional backup passwords with cryptographic keys stored securely on the user's device. The update aims to simplify the backup security model and reduce risks associated with weak or forgotten passwords, as the device's biometric or lock code now serves as the primary gatekeeper for backup access. The introduction of passkey-encrypted backups reflects a broader industry shift toward passwordless authentication, with passkeys gaining traction among users seeking enhanced security and convenience. WhatsApp users can enable this feature by navigating to Settings > Chats > Chat backup > End-to-end encrypted backup, and the rollout is expected to reach all users over the coming months. This move builds on WhatsApp's previous implementation of end-to-end encrypted chat backups and further strengthens the privacy and security of user data stored on cloud services like iCloud and Google Drive.
Jul 12, 2026
WhatsApp has begun rolling out global username reservations for a new privacy feature that lets people connect without exposing their phone numbers. The change, aimed at the platform’s more than three billion users, will allow new contacts and businesses to start conversations using a unique username instead of a phone number, with broader availability expected later in 2026. WhatsApp said the feature is designed for scenarios such as meeting strangers, joining group chats, and making professional connections, while creators, small businesses, and organizations may be able to claim matching Instagram or Facebook names. The company said discovery will be tightly limited: there will be no public directory, no browsable listings, and no username suggestion algorithm, so a person must know the exact username to initiate first contact. WhatsApp is also introducing an optional **username key**, a secondary credential that requires someone to know both the username and the key before they can message a user for the first time, adding another layer of protection against unwanted outreach and reducing exposure of users’ phone numbers.
Jul 3, 2026
WhatsApp announced a new optional security mode, **“Strict Account Settings,”** designed to reduce exposure to *highly sophisticated attacks*—particularly **mercenary spyware**—by limiting risky functionality when enabled. The feature is expected to roll out in the coming weeks and includes restrictions such as blocking attachments and media from people not in a user’s contact list; it can be enabled via `Settings > Privacy > Advanced`. WhatsApp positioned the change as an additional layer beyond default **end-to-end encryption**, aimed at higher-risk users such as journalists and public-facing figures, and noted its ongoing legal fight with **NSO Group** over the 2019 Pegasus campaign that targeted roughly 1,400 WhatsApp users. The approach mirrors Apple’s **Lockdown Mode**, which similarly reduces attack surface for a small subset of users who may be personally targeted by advanced threats by disabling or constraining features across core services. Apple documents that Lockdown Mode blocks most message attachment types, limits complex web technologies, restricts incoming FaceTime calls to recent contacts, blocks certain Apple service invitations, and removes some photo-sharing metadata—trading usability for stronger protection against targeted exploitation. Together, the updates reflect a broader industry pattern of offering *opt-in, high-friction hardening modes* to mitigate spyware and other highly targeted intrusion techniques.
Jun 29, 2026