New zero-click exploit allegedly used to hack WhatsApp users

A new zero-click exploit allegedly used to hack WhatsApp users has been reported, with WhatsApp sending threat notifications to individuals they believe were targeted in the past 90 days. The attack required no user interaction, and Amnesty researchers flagged that the exploit targeted an authorization bypass issue tracked as CVE-2025-55177 in WhatsApp on iOS and Mac, enabling attackers to force “content from arbitrary URL” to be rendered on a target’s device.

The campaign also involved a zero-click vulnerability that Apple recently patched (CVE-2025-43300) and was used in the attacks, according to AmnestyTech. The WhatsApp zero-click attack affects both iPhone and Android users, including civil society. WhatsApp has since patched the flaw, but the message urges affected individuals to review devices, update to the latest OS and WhatsApp version, and consider a full device reset. The disclosure comes as the security community notes that commercial spyware vendors are behind many zero-day exploits discovered in the wild.