WhatsApp users targeted by zero-click account hijacking scams

Cybersecurity experts and law enforcement are warning of a rise in WhatsApp account compromises, specifically through “zero-click” attacks. These attacks exploit technical vulnerabilities in mobile operating systems or the application itself, allowing hackers to gain access to an account without the user clicking a link or scanning a code.

Once an account is compromised, fraudsters use the victim's identity—including their name and profile picture—to send urgent requests for money to the victim's contacts. These messages often cite emergencies, such as medical bills or banking issues, to exploit trust and urgency. In some regions, such as the Spanish province of Huelva, dozens of complaints have already been filed regarding this specific fraud.

To protect against these threats, authorities recommend maintaining up-to-date software, enabling two-step verification, and regularly checking “Linked Devices” in WhatsApp settings to disconnect unrecognized sessions. Most importantly, users are advised to verify any financial requests through a separate communication channel, such as a direct phone call, before sending funds.