Loading story…
WhatsApp has begun rolling out global username reservations for a new privacy feature that lets people connect without exposing their phone numbers. The change, aimed at the platform’s more than three billion users, will allow new contacts and businesses to start conversations using a unique username instead of a phone number, with broader availability expected later in 2026. WhatsApp said the feature is designed for scenarios such as meeting strangers, joining group chats, and making professional connections, while creators, small businesses, and organizations may be able to claim matching Instagram or Facebook names.
The company said discovery will be tightly limited: there will be no public directory, no browsable listings, and no username suggestion algorithm, so a person must know the exact username to initiate first contact. WhatsApp is also introducing an optional username key, a secondary credential that requires someone to know both the username and the key before they can message a user for the first time, adding another layer of protection against unwanted outreach and reducing exposure of users’ phone numbers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The Indian government issued a formal notice to WhatsApp LLC ordering it not to roll out the new usernames feature in India until consultations are completed. Officials said the feature could enable fraud, phishing, impersonation, and digital arrest scams, and required WhatsApp to explain its safeguards within three days.
WhatsApp announced that it has started accepting global username reservations as part of a new privacy feature that lets users connect without exposing their phone numbers. The rollout is beginning gradually by region ahead of broader availability later in 2026, and the company is also introducing optional username keys for added protection on first contact.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcecysecurity.news
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcesecurityweek.com
Open sourcebleepingcomputer.com
Open sourcefaq.whatsapp.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WhatsApp is preparing to introduce unique usernames that would let people message each other without sharing phone numbers, a change positioned as a privacy improvement for group chats, events, and first-time contacts. The feature is designed without a public directory, requiring users to know an exact username, but officials and cybersecurity authorities have warned it could also make impersonation and phishing easier by allowing attackers to register lookalike names resembling trusted individuals, brands, banks, or government bodies. India’s Ministry of Electronics and Information Technology (**MeitY**) has asked WhatsApp to suspend the rollout until it receives government approval, arguing the feature could fuel phishing, so-called digital arrest scams, and fraud targeting public authorities and financial institutions in WhatsApp’s largest market of more than 850 million users. WhatsApp said it plans safeguards including contextual warnings, reserved usernames for legitimate organizations, lookalike protections, contact-initiation limits, anti-enumeration controls, and abuse-detection systems, while security guidance has urged users to verify suspicious contacts through official channels and advised organizations to reserve official usernames early and clearly communicate their legitimate accounts.
Jul 8, 2026
Meta’s WhatsApp is developing an **optional account password** feature for Android that adds a new authentication step on top of the existing registration flow, according to references found in *WhatsApp Beta for Android* `2.26.7.8` distributed via the Google Play Beta Program. The feature would let users set an alphanumeric password **6–20 characters** long, requiring at least **one letter and one number**, with in-app guidance on password strength; users would be able to **change or remove** the password at any time. The password is intended to reduce **account takeover** risk in scenarios such as **SIM swapping**, intercepted verification codes, or compromised devices. During login, WhatsApp would prompt for the password **after** the 6-digit SMS verification code; if **two-step verification (PIN-based 2FA)** is also enabled, the user would enter the 2FA code and then the account password. The work builds on WhatsApp’s existing optional protections, including two-step verification and account recovery via a registered email address.
Jun 29, 2026
Researchers have discovered that WhatsApp's phone number discovery feature allows for mass enumeration of user phone numbers, exposing the personal information of up to 3.5 billion users. By automating the process of checking which numbers are registered on WhatsApp, attackers can compile extensive lists of active users, potentially leading to privacy violations, targeted phishing, and other malicious activities. This vulnerability, which was first warned about eight years ago, remains unmitigated, raising significant concerns about the platform's approach to user data protection. The issue has gained renewed attention after a team from the University of Vienna demonstrated the scale of the exposure, calling it "the most extensive exposure of phone numbers" ever seen. Security experts warn that the lack of effective rate limiting or other technical safeguards enables this enumeration attack, and the incident has been widely reported in security news outlets and discussed in industry podcasts. The exposure underscores the ongoing risks associated with user enumeration flaws in major messaging platforms and the need for stronger privacy controls.
Jun 29, 2026