WhatsApp vulnerability allowed government-grade spyware to be installed

WhatsApp, one of the most popular messaging apps out there, has once again been the subject of hacking, but this time the method used involves government-grade spyware. Although we have no information that would confirm who’s behind the attack, the spyware used is usually sold to governments.

The vulnerability discovered by WhatsApp just a few weeks ago would allow a caller to install spyware on the device being called, regardless of whether or not the could be answered.

The spyware installed was made by Israel-based NSO Group Pegasus, and is usually licensed to governments that want to hack targets of investigations and gain access to multiple aspects of their devices.

It’s unclear how many Android and iOS devices were affected by the vulnerability, but as you can imagine, anyone with access to the spyware could hack any WhatsApp user. On the bright side, WhatsApp said that it took less than 10 days after it discovered the security issue to patch it. The company also believes that only a relatively small number of users were targeted by the attack.

This attack has all the hallmarks of a private company known to work with governments to deliver spyware that reportedly takes over the functions of mobile phone operating systems. We have briefed a number of human rights organizations to share the information we can, and to work with them to notify civil society.

If you have WhatsApp installed on your phone, installing the latest version of the app will render the attack inoperable, even if it was infected with the government-grade spyware.