Archive — US — techcrunch
WhatsApp fixes ‘zero-click’ bug used to hack Apple users with spyware
WhatsApp fixed a 'zero-click' security flaw, CVE-2025-55177, affecting iOS and Mac that enabled spyware attacks on Apple devices of specific users. This vulnerability was exploited alongside another flaw in iOS. WhatsApp notified fewer than 200 affected users, while discussions around the identity of the attackers continue amidst ongoing security concerns regarding government spyware targeting its users.
Key points
- WhatsApp identified and patched the zero-click vulnerability CVE-2025-55177.
- The flaw allowed stealthy attacks on specific users' Apple devices, exploiting a separate iOS vulnerability (CVE-2025-43300).
- Donncha Ó Cearbhaill emphasized the sophistication of the spyware campaigns targeting WhatsApp users over the past 90 days.
- The attack could compromise devices and access sensitive data without the user's interaction.
- Meta confirmed fewer than 200 notifications were sent to affected users regarding the breach.
Why it matters
- This incident highlights ongoing vulnerabilities in popular communication platforms, especially under the rise of government spyware.
- It relates to historical attacks on WhatsApp users and suits highlighting the misuse of technology for surveillance.
- The increasing sophistication of spyware is a critical concern in IT security trends, especially with transitions to remote work and digital communication.
The resolution of this vulnerability by WhatsApp underscores ongoing risks of sophisticated cyberattacks on popular messaging platforms, necessitating continuous vigilance and enhanced security protocols to protect user data.