{"id":1701,"date":"2025-02-07T14:27:57","date_gmt":"2025-02-07T21:27:57","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/?p=1701"},"modified":"2025-02-07T14:28:01","modified_gmt":"2025-02-07T21:28:01","slug":"the-zero-click-attack-whatsapp-under-targeted-spyware","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/2025\/02\/07\/the-zero-click-attack-whatsapp-under-targeted-spyware\/","title":{"rendered":"The Zero-Click Attack: WhatsApp Under Targeted Spyware"},"content":{"rendered":"\n<p>In a shocking disclosure,&nbsp; WhatsApp revealed that it just discovered a sophisticated cyberattack aiming at about 100 people, including members of civil society and journalists spread across more than two dozen countries. Tracing the hack to Israeli monitoring company Paragon Solutions, privacy, press freedom, and human rights have once more been under question.[1]<\/p>\n\n\n\n<h5 class=\"wp-block-heading has-normal-font-size\">How the Attack was Discovered ? <\/h5>\n\n\n\n<p>WhatsApp&#8217;s security team found odd activity and identified a &#8220;zero-click&#8221; attack. Zero-click exploits are rather risky since they lack user interaction unlike conventional cyberattacks.&nbsp;<\/p>\n\n\n\n<p>Using code flaws in the software, the attackers delivered several dangerous PDF files over WhatsApp group chats. Once turned on, the malware stealthily stole images, passwords, encrypted messages, even control over the microphone and camera from the devices.<\/p>\n\n\n\n<p>WhatsApp tracked the attack back to Paragon Solutions and disturbed the exploit in December 2024 after working with Citizen Lab, a cybersecurity research group at the University of Toronto. Notified affected users, Paragon received a cease-and-desist letter to try to make them answerable.[1][7]<\/p>\n\n\n\n<p>A WhatsApp spokesman reiterated the platform&#8217;s position on user privacy:&nbsp;<\/p>\n\n\n\n<p>&#8220;This is the latest example of why spyware businesses must be held accountable for their illicit conduct. WhatsApp will keep safeguarding people&#8217;s right to have private communication.&#8221;<\/p>\n\n\n\n<p class=\"has-normal-font-size\"><strong>What is a Zero Click Attack ?<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"961\" height=\"543\" data-src=\"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-content\/uploads\/sites\/119\/2025\/02\/Screenshot-2025-02-07-141716-1.png\" alt=\"\" class=\"wp-image-1704 lazyload\" data-srcset=\"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-content\/uploads\/sites\/119\/2025\/02\/Screenshot-2025-02-07-141716-1.png 961w, https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-content\/uploads\/sites\/119\/2025\/02\/Screenshot-2025-02-07-141716-1-300x170.png 300w, https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-content\/uploads\/sites\/119\/2025\/02\/Screenshot-2025-02-07-141716-1-768x434.png 768w\" data-sizes=\"(max-width: 961px) 100vw, 961px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 961px; --smush-placeholder-aspect-ratio: 961\/543;\" \/><\/figure>\n\n\n\n<p>Among the most sophisticated cyberattacks, zero-click assaults demand no victim action. Rather, attackers take advantage of weaknesses in automatically processing incoming data applications as email and messaging systems. Since these attacks can use encrypted channels and self-destructing messages, they are challenging to identify. [2] [1]<\/p>\n\n\n\n<p class=\"has-normal-font-size\"><strong>How it works ?<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Exploiting Vulnerabilities &#8211; <\/strong>Targeting weaknesses in software, especially in applications handling untrusted input, attackers aim to These can be unpatched flaws or zero-day vulnerabilities\u2014previously unheard-of to developers.<\/li>\n\n\n\n<li><strong>Delivering malicious codes<\/strong> &#8211; The exploit is communicated via trusted channels from apparently benign material including an image, PDF, or text message.<\/li>\n\n\n\n<li><strong>Executing the Attack &#8211; <\/strong>Once processed, the spyware installs itself and provides access to sensitive data including messages, pictures, passwords, even real-time microphone or camera feeds.<\/li>\n\n\n\n<li><strong>Stealth and Automation<\/strong>: These almost impossible to detect attacks leave\u00a0 little traces. [3]<\/li>\n<\/ol>\n\n\n\n<p class=\"has-normal-font-size\"><strong> WhatsApp<\/strong>&#8216;<strong>s Response :\u00a0<\/strong><\/p>\n\n\n\n<p>WhatsApp immediately acted against Paragon Solutions after effectively blocking the attack route employed in this operation. The corporation sent a cease-and-desist letter and extensively examined the hack under the direction of cybersecurity specialists. Affected consumers were also given direction and information on protecting their devices.[7]&nbsp;<\/p>\n\n\n\n<p class=\"has-normal-font-size\"><strong>Calls for Accountability<\/strong><\/p>\n\n\n\n<p>The WhatsApp hack highlights how urgently better laws on the creation and use of spyware are needed. Unchecked spread of such technology, advocacy organizations underline, compromises individual privacy, journalistic freedom, even democratic institutions. They demand more responsibility and openness from government agencies running these tools as well as from spyware producers.[7]&nbsp;<\/p>\n\n\n\n<p class=\"has-normal-font-size\"><strong>Notable Zero-Click Attacks from past<\/strong><\/p>\n\n\n\n<p>This occurrence is not the first one. The past has seen several other well-known zero-click attacks documented:<\/p>\n\n\n\n<p>\u25cf Pegasus Spyware (NSO Group) targets activists, reporters, and even government officials all over.<\/p>\n\n\n\n<p>\u25cf Apple iMessage FORCEDENTRY Exploit: Let attackers remotely install spyware bypassing Apple security.<\/p>\n\n\n\n<p>\u25cf WhatsApp Missed Call Exploit: Through a missed call, a vulnerability let malware infect a device.<\/p>\n\n\n\n<p>\u25cf Apple Blast Door Vulnerability: Taken advantage of to send iMessage zero-click spyware.[8]<\/p>\n\n\n\n<p class=\"has-normal-font-size\"><strong>Conclusion <\/strong>:\u00a0<\/p>\n\n\n\n<p>Commercial spyware is evolving and easily accessible, hence the potential of abuse is rising. To control these dangers, stronger cybersecurity rules, more thorough international control, and improved digital defenses are needed. People also have to be conscious by keeping softwares updated, removing outdated apps, and employing security-oriented solutions to protect their personal data.[8]<\/p>\n\n\n\n<p class=\"has-large-font-size\">References :\u00a0<\/p>\n\n\n\n<p>[1] WhatsApp says journalists and civil society members were targets of Israeli spyware-<strong> <\/strong><a href=\"https:\/\/www.theguardian.com\/technology\/2025\/jan\/31\/whatsapp-israel-spyware\"><strong>https:\/\/www.theguardian.com\/technology\/2025\/jan\/31\/whatsapp-israel-spyware<\/strong><\/a><\/p>\n\n\n\n<p>[2] Zero Click Exploits &#8211;<\/p>\n\n\n\n<p><a href=\"https:\/\/www.kaspersky.com\/resource-center\/definitions\/what-is-zero-click-malware\">https:\/\/www.kaspersky.com\/resource-center\/definitions\/what-is-zero-click-malware<\/a><\/p>\n\n\n\n<p>[3] An Introduction to Zero-click attacks<\/p>\n\n\n\n<p><a href=\"https:\/\/www.lrqa.com\/en\/insights\/articles\/an-introduction-to-zero-click-attacks\">https:\/\/www.lrqa.com\/en\/insights\/articles\/an-introduction-to-zero-click-attacks<\/a><\/p>\n\n\n\n<p>[4] WhatsApp Zero-Click Paragon Spyware Terminates Contract with Italy- <a href=\"https:\/\/cybersecuritynews.com\/whatsapp-zero-click-paragon-spyware\/\">https:\/\/cybersecuritynews.com\/whatsapp-zero-click-paragon-spyware\/<\/a><\/p>\n\n\n\n<p>[5] WhatsApp Hack Alert: Your phone might be hacked without clicking any link. Know about the &#8216;Zero-Click&#8217; spyware &#8211;<a href=\"https:\/\/economictimes.indiatimes.com\/?back=1\">https:\/\/economictimes.indiatimes.com\/?back=1<\/a><\/p>\n\n\n\n<p>[6] What\u2019s a Zero-Click Exploit &amp; Zero-Click Malware? &#8211; <a href=\"https:\/\/sectigostore.com\/blog\/whats-a-zero-click-exploit-zero-click-malware\/\">https:\/\/sectigostore.com\/blog\/whats-a-zero-click-exploit-zero-click-malware\/<\/a><\/p>\n\n\n\n<p>[7] Israeli Firm Paragon Deploys Zero-Click Spyware to Compromise WhatsApp &#8211; <a href=\"https:\/\/hoploninfosec.com\/paragon-deploys-zero-click-spyware-to-whatsapp\/\">https:\/\/hoploninfosec.com\/paragon-deploys-zero-click-spyware-to-whatsapp\/<\/a><\/p>\n\n\n\n<p>[8] What is zero click attack ? Examples and Prevention&nbsp; <a href=\"https:\/\/www.wallarm.com\/what\/zero-click-attack\">https:\/\/www.wallarm.com\/what\/zero-click-attack<\/a><\/p>\n\n\n\n<p>Fig-1 <a href=\"https:\/\/www.pcmag.com\/how-to\/what-is-a-zero-click-attack\">https:\/\/www.pcmag.com\/how-to\/what-is-a-zero-click-attack<\/a><br><\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In a shocking disclosure,&nbsp; WhatsApp revealed that it just discovered a sophisticated cyberattack aiming at about 100 people, including members of civil society and journalists spread across more than two dozen countries. Tracing the hack to Israeli monitoring company Paragon Solutions, privacy, press freedom, and human rights have once more been under question.[1] How the &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/2025\/02\/07\/the-zero-click-attack-whatsapp-under-targeted-spyware\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;The Zero-Click Attack: WhatsApp Under Targeted Spyware&#8221;<\/span><\/a><\/p>\n","protected":false},"author":686,"featured_media":1705,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[1],"tags":[40],"class_list":["post-1701","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-isec-611","entry"],"featured_image_src":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-content\/uploads\/sites\/119\/2025\/02\/background-600x400.jpg","featured_image_src_square":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-content\/uploads\/sites\/119\/2025\/02\/background-600x400.jpg","author_info":{"display_name":"Krupali Kanubhai Patel","author_link":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/author\/krupali-kanubhai-patel\/"},"_links":{"self":[{"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/posts\/1701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/users\/686"}],"replies":[{"embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/comments?post=1701"}],"version-history":[{"count":1,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/posts\/1701\/revisions"}],"predecessor-version":[{"id":1706,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/posts\/1701\/revisions\/1706"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/media\/1705"}],"wp:attachment":[{"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/media?parent=1701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/categories?post=1701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/tags?post=1701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}