Loading story…
Attaullah Baig, former head of security at WhatsApp, has filed a lawsuit against Meta, alleging he was fired in retaliation for reporting systemic security and privacy failures. Baig claims WhatsApp allowed approximately 1,500 engineers unfettered access to sensitive user data, lacked proper data inventory and monitoring, and failed to prevent large-scale account takeovers. Meta denies the allegations, attributing Baig's dismissal to poor performance and asserting its commitment to user privacy.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
5 references tracked. Mallory keeps watching after this page renders.
schneier.com
Open sourcescworld.com
Open sourcetechrepublic.com
Open sourcecyberscoop.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new class-action lawsuit filed in the U.S. District Court for the Northern District of California alleges **Meta** misled WhatsApp users by marketing “unbreakable” end-to-end encryption while allegedly retaining and analyzing message content and enabling employee access via internal tools. The complaint—brought by plaintiffs from multiple countries and seeking global class certification—cites unnamed whistleblowers but reportedly provides no technical proof (e.g., logs or code) to substantiate claims that Meta can decrypt or read message contents; Meta spokesperson Andy Stone denied the allegations as “categorically false,” reiterating WhatsApp’s use of the **Signal Protocol** for end-to-end encryption. Separately, **Google** agreed to pay **$68 million** to settle a class-action lawsuit alleging **Google Assistant** unlawfully recorded users’ private conversations when inadvertently triggered (e.g., via “Hey Google” misfires) and shared recordings with third parties for advertising-related purposes. The preliminary settlement, also filed in Northern California federal court, still requires judicial approval and applies to purchasers of Google devices dating back to May 2016; Google reportedly settled without admitting wrongdoing. Together, the cases underscore ongoing legal and regulatory exposure tied to consumer privacy representations, data handling, and the gap between product claims and alleged internal access/collection practices.
Jun 29, 2026
Meta said it disrupted a new **NSO Group-linked** operation that used **one-click phishing** against WhatsApp users and has asked a U.S. federal court to hold the spyware vendor in contempt for allegedly violating a permanent injunction. According to WhatsApp, the activity relied on malicious external links, social engineering, and WhatsApp test accounts and groups used to stage the attacks, echoing tactics previously associated with **Pegasus** spyware campaigns. Meta also published malicious domains and related indicators tied to the infrastructure and said it removed the accounts involved. The alleged targeting primarily affected fewer than 10 users in **Jordan and Lebanon**, and WhatsApp said it found no evidence of successful device compromise. The filing follows earlier court action over NSO’s 2019 campaign that exploited a WhatsApp **VOIP stack** buffer overflow to compromise about 1,400 users, a case that resulted in a jury award of more than **$167 million** in punitive damages plus compensatory damages and a court order barring NSO from targeting WhatsApp or its users. Meta said the new activity shows continued exploit development and spyware operations despite that injunction.
Aug 11, 2026
A group of Austrian researchers demonstrated that WhatsApp's contact discovery feature could be abused to enumerate and extract the phone numbers of 3.5 billion users globally. By automating the process of checking every possible phone number through WhatsApp’s browser-based app, the researchers were able to access not only phone numbers but also profile photos for 57% of users and profile text for 29%. This large-scale data exposure was possible because Meta, WhatsApp’s parent company, did not sufficiently limit the speed or volume of contact discovery requests, despite prior warnings about this vulnerability. In response to this and other security concerns, Meta has expanded its bug bounty initiatives, launching the WhatsApp Research Proxy tool to facilitate deeper research into WhatsApp’s network protocol and platform abuse. The company also reported adding new anti-scraping protections to WhatsApp after the enumeration technique was disclosed. Meta highlighted its ongoing investment in security, noting over $4 million in bug bounties paid out in the past year and the patching of several notable vulnerabilities, including CVE-2025-59489 affecting Quest devices.
Jun 29, 2026