A Silent Vulnerability Turns WhatsApp Accounts into a Trap for Friends

Requests for money may come from a real friend’s account without the owner knowing that the message was sent under their name.

This is what was revealed by cases observed in Italy, where WhatsApp accounts on iPhones were used without authorization to message new contacts and request money transfers.

According to Spain’s National Cybersecurity Institute (INCIBE), the examined cases involved iPhones ranging from the iPhone 8 to the iPhone 14, running various versions of iOS 16. Investigators found no unfamiliar devices listed under “Linked Devices,” and victims confirmed they had not shared a verification code or approved the linking of a new device.

The Italian digital forensics company Forenser preliminarily linked the incidents to a potential series of two security vulnerabilities in Apple’s image processing system and WhatsApp’s device synchronization mechanism. However, the institute emphasized that WhatsApp has not officially confirmed that the May 2026 cases resulted specifically from this series of vulnerabilities.

Apple and WhatsApp had patched these vulnerabilities during 2025, but devices that remained on older versions may still be at risk.

To reduce risks, users are advised to immediately update their phone’s operating system and the WhatsApp application, and to enable two-factor authentication.

Additionally, money should not be transferred in response to a sudden message without first contacting the account holder by phone or through an independent channel to verify their identity.