Loading story…
WhatsApp announced a set of account security upgrades that expand phishing-resistant sign-ins and strengthen user authentication. The company said more than 1 billion people already use a passkey to access WhatsApp, and users can now register multiple passkeys to support sign-ins across both iOS and Android devices. The update also replaces WhatsApp’s previous six-digit two-step verification PIN with a full password option that can be longer and include alphanumeric and special characters.
WhatsApp also introduced additional caller context for incoming calls from unknown numbers on Android to help users spot potential scams. The app will display details such as the caller’s country or call origin, whether the number is already in the user’s contacts, and whether the caller shares common WhatsApp groups with the recipient. The changes follow WhatsApp’s recent rollout of Scam Alert, an optional AI-based feature designed to flag suspicious messages from non-contacts.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
In January, WhatsApp began rolling out Strict Account Settings, an Apple Lockdown-style protection for high-risk users such as journalists and public figures. The feature is intended to help defend against sophisticated threats including spyware attacks.
Meta integrated passkeys into Facebook logins as part of its broader adoption of passkey-based authentication across services.
WhatsApp later expanded passkey support to iOS, extending passkey-based sign-ins beyond Android devices.
WhatsApp first introduced passkey support on Android, establishing passkeys as a sign-in option for the app.
WhatsApp previously introduced alerts intended to warn users about fraudulent device-linking requests, supplementing its account-security protections.
WhatsApp added extra context for incoming calls from non-contacts on Android, including details such as the caller's country or origin and whether the caller shares groups with the recipient. The feature is intended to help users identify potential scam calls before answering.
WhatsApp announced new account security features including support for multiple passkeys on one account and replacing the previous six-digit two-step verification PIN with a longer password that can include alphanumeric and special characters. The company also said more than 1 billion people now use a passkey to sign in to WhatsApp.
A couple of weeks before the latest security update, WhatsApp unveiled Scam Alert, an optional AI-based feature that flags suspicious messages from non-contacts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
15 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourcescworld.com
Open sourcetechrepublic.com
Open sourceabout.fb.com
Open sourcesecurityweek.com
Open sourcebleepingcomputer.com
Open sourceblog.whatsapp.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Meta’s WhatsApp is developing an **optional account password** feature for Android that adds a new authentication step on top of the existing registration flow, according to references found in *WhatsApp Beta for Android* `2.26.7.8` distributed via the Google Play Beta Program. The feature would let users set an alphanumeric password **6–20 characters** long, requiring at least **one letter and one number**, with in-app guidance on password strength; users would be able to **change or remove** the password at any time. The password is intended to reduce **account takeover** risk in scenarios such as **SIM swapping**, intercepted verification codes, or compromised devices. During login, WhatsApp would prompt for the password **after** the 6-digit SMS verification code; if **two-step verification (PIN-based 2FA)** is also enabled, the user would enter the 2FA code and then the account password. The work builds on WhatsApp’s existing optional protections, including two-step verification and account recovery via a registered email address.
Jun 29, 2026
WhatsApp has announced the rollout of passkey-encrypted chat backups for both iOS and Android devices, allowing users to secure their stored message history using biometric authentication methods such as fingerprint, face recognition, or device screen-lock codes. This new feature leverages passwordless authentication standards like FIDO2/WebAuthn, replacing traditional backup passwords with cryptographic keys stored securely on the user's device. The update aims to simplify the backup security model and reduce risks associated with weak or forgotten passwords, as the device's biometric or lock code now serves as the primary gatekeeper for backup access. The introduction of passkey-encrypted backups reflects a broader industry shift toward passwordless authentication, with passkeys gaining traction among users seeking enhanced security and convenience. WhatsApp users can enable this feature by navigating to Settings > Chats > Chat backup > End-to-end encrypted backup, and the rollout is expected to reach all users over the coming months. This move builds on WhatsApp's previous implementation of end-to-end encrypted chat backups and further strengthens the privacy and security of user data stored on cloud services like iCloud and Google Drive.
Jul 12, 2026
WhatsApp has begun rolling out global username reservations for a new privacy feature that lets people connect without exposing their phone numbers. The change, aimed at the platform’s more than three billion users, will allow new contacts and businesses to start conversations using a unique username instead of a phone number, with broader availability expected later in 2026. WhatsApp said the feature is designed for scenarios such as meeting strangers, joining group chats, and making professional connections, while creators, small businesses, and organizations may be able to claim matching Instagram or Facebook names. The company said discovery will be tightly limited: there will be no public directory, no browsable listings, and no username suggestion algorithm, so a person must know the exact username to initiate first contact. WhatsApp is also introducing an optional **username key**, a secondary credential that requires someone to know both the username and the key before they can message a user for the first time, adding another layer of protection against unwanted outreach and reducing exposure of users’ phone numbers.
Jul 3, 2026