Loading story…
WhatsApp is developing Restricted Chat, an optional per-conversation privacy setting discovered in Android beta 2.26.36.5. The feature would keep selected chats on the account’s primary phone and block their synchronization to WhatsApp Web, desktop applications, and linked secondary devices, reducing the exposure of sensitive conversations through multi-device access.
Restricted Chat appears to extend WhatsApp’s Advanced Chat Privacy protections, including restrictions on chat export, automatic media saving, and Meta AI use for protected conversations. The capability remains under development and is not yet available to beta testers; WhatsApp has not announced a release date for Android, iOS, Web, or desktop. It cannot prevent participants from manually copying messages, taking screenshots, photographing content, or sharing it outside WhatsApp.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
WhatsApp introduced its Advanced Chat Privacy setting, which restricts chat export, automatic media saving, and Meta AI use for protected conversations.
WhatsApp was found developing an optional per-conversation Restricted Chat feature in Android beta 2.26.36.5 that would keep selected chats off WhatsApp Web, desktop clients, and linked secondary phones. The feature was not enabled for beta testers and had no announced public release date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcewabetainfo.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WhatsApp announced a new optional security mode, **“Strict Account Settings,”** designed to reduce exposure to *highly sophisticated attacks*—particularly **mercenary spyware**—by limiting risky functionality when enabled. The feature is expected to roll out in the coming weeks and includes restrictions such as blocking attachments and media from people not in a user’s contact list; it can be enabled via `Settings > Privacy > Advanced`. WhatsApp positioned the change as an additional layer beyond default **end-to-end encryption**, aimed at higher-risk users such as journalists and public-facing figures, and noted its ongoing legal fight with **NSO Group** over the 2019 Pegasus campaign that targeted roughly 1,400 WhatsApp users. The approach mirrors Apple’s **Lockdown Mode**, which similarly reduces attack surface for a small subset of users who may be personally targeted by advanced threats by disabling or constraining features across core services. Apple documents that Lockdown Mode blocks most message attachment types, limits complex web technologies, restricts incoming FaceTime calls to recent contacts, blocks certain Apple service invitations, and removes some photo-sharing metadata—trading usability for stronger protection against targeted exploitation. Together, the updates reflect a broader industry pattern of offering *opt-in, high-friction hardening modes* to mitigate spyware and other highly targeted intrusion techniques.
Jun 29, 2026
WhatsApp has begun a limited beta rollout of **Scam Alert**, an optional feature that uses on-device machine learning to flag likely scam messages from non-contacts while preserving end-to-end encryption. Users can decide whether to block, report, continue, or trust a flagged conversation, and can review Scam Alert activity in the app. WhatsApp said message content does not leave the device for classification, and the company has expanded its bug bounty program to cover the new feature, including its model weights and analytics pipeline. To reduce privacy risks and targeted manipulation, WhatsApp said it verifies model releases through a transparency process that publishes each version’s `SHA-256` hash to a third-party append-only ledger before deployment, while model downloads are routed through OHTTP relays with anonymous credentials. The company also said it measures effectiveness through a confidential federated analytics pipeline using Trusted Execution Environments, anonymous aggregation, and differential privacy, and may let users optionally share the last five messages from trusted chats to improve model accuracy. The rollout comes as Signal has also introduced automatic key verification based on key transparency logs and independent auditing to detect unauthorized public key changes in encrypted conversations.
Aug 19, 2026
Meta has launched **Incognito Chat** for Meta AI on WhatsApp and the standalone Meta AI app, introducing a private conversation mode that the company says even Meta cannot access. The feature is built on WhatsApp’s **Private Processing** technology, which Meta says handles prompts in a secure environment, avoids storing conversations on its servers, and deletes messages by default when the session ends. Meta published a technical whitepaper on the system and said the feature will roll out gradually over the coming months. The launch extends WhatsApp’s privacy positioning into AI interactions and arrives amid broader regulatory and public scrutiny over how AI assistants embedded in messaging platforms handle user data. Meta also announced **Side Chat**, an upcoming WhatsApp capability that will use the same Private Processing approach to provide AI help inside ongoing conversations without disrupting the main chat, though the company has not yet provided a firm release date or clarified whether availability will be global or limited by region.
Jun 29, 2026