Feeds.Feedburner Zero-Click Attack Compromises WhatsApp Accounts on iOS 16
Article Content
- •Zero-click attack exploits CVE-2025-43300 and CVE-2025-55177 on iOS 16.
- •Victims' WhatsApp accounts are hijacked without user interaction or notifications.
- •Immediate updates to iOS and WhatsApp are recommended to mitigate risks.
A sophisticated zero-click attack has been identified, targeting iPhones running iOS 16 and enabling attackers to hijack WhatsApp accounts without user interaction. The attack exploits vulnerabilities CVE-2025-43300 and CVE-2025-55177, allowing unauthorized access to WhatsApp sessions. Victims report their accounts sending fraudulent money requests without any notifications or linked device alerts. The Italian digital forensics firm Forenser confirmed the attack after multiple user reports. Users are advised to update their iOS and WhatsApp apps, lock their chats, and verify any money requests through direct communication. This incident illustrates the growing sophistication of cybercrime, particularly financially motivated attacks leveraging zero-day exploits. The attack is ongoing, with no confirmed patch available for the vulnerabilities yet.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track CVE-2025-43300 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Apple Patches CoreGraphics Zero-Day Exploited in Targeted Attacks Apple has released emergency updates for iOS, iPadOS, and macOS to address a critical zero-day vulnerability, CVE-2026-86950, in its CoreGraphics framework. This out-of-bounds write flaw can allow arbitrary code execution when a device processes a maliciously crafted file. The vulnerability was reportedly exploited in… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…