How a Single WhatsApp Message Can Take Control of Your Phone
How a Single WhatsApp Message Can Take Control of Your Phone#### All it takes is one message on WhatsApp, and you don’t even have to open it. The exploit is already running in the background, and the attacker has full control over your device.
WhatsApp, one of the world’s most widely used communication apps, has recently become the target of a sophisticated “zero-click” attack that exploits a combination of critical vulnerabilities in both WhatsApp itself and Apple’s operating systems.
The vulnerabilities are tracked as CVE-2025–55177 (WhatsApp) and CVE-2025–43300 (Apple ImageIO). The first flaw allows an attacker to send a sync message to the app that is not properly validated. As a result, the app downloads and processes malicious content from a remote server. The second vulnerability in the DNG image parser allows the attacker to achieve an “out-of-bounds write” in memory and execute arbitrary code.
The entire exploit chain runs without requiring user interaction — simply receiving a message from the attacker via WhatsApp is enough. No click or file opening is necessary; the user notices nothing.
The attackers’ goal is typically persistent device control. This gives them not only complete insight into the victim’s communications, but also the ability to remotely manage the device, upload additional malware, change its settings, and obtain sensitive data.
Defense primarily involves immediately updating WhatsApp to the latest version, as well as updating the Apple operating system. WhatsApp and Apple security teams responded by releasing patches within days of discovering the attack. In case of suspected device compromise, they recommend not only updating but also performing a complete factory reset of the device, which ensures the removal of all malicious code.
Dangerous SORVEPOTEL Malware Masquerades as Messages from Your WhatsApp Friends
Let’s stay with WhatsApp a bit longer. Security researchers from Trend Micro have warned about the insidious SORVEPOTEL malware, which is spreading extremely rapidly through the popular WhatsApp communication app. This attack hides its malicious files in regular messages from compromised contacts, allowing attackers to exploit user trust for massive spreading among Windows devices.
The infection mechanism begins with a phishing message containing a ZIP attachment posing as a receipt or health app. After opening it, the user is led to run an LNK file, which unknowingly activates a PowerShell script and downloads the main malicious code from the attackers’ servers. The malware also saves itself to the auto-start folder to survive system restarts.
The central element of the campaign is the automated spreading of malware through WhatsApp Web. If the malware detects an active desktop version, it automatically sends the infected ZIP to all of the victim’s contacts and groups.
The campaign is geographically concentrated in Brazil — up to 96% of cases were recorded there. The most common victims include businesses in government, technology, manufacturing, and education sectors.
Massive Red Hat Breach: 570 GB of Sensitive Customer Data in Hackers’ Hands
Red Hat confirmed a major security incident where a hacker group known as Crimson Collective compromised their private GitLab instance used for consulting projects. The attackers claim they gained access to more than 28,000 internal repositories and stole approximately 570 GB of compressed data, including Customer Engagement Reports (CER) documents from 2020–2025. These repositories contained detailed technical information about customer infrastructure, architectural designs, network topologies, and credentials.
Many key organizations across industries are at risk — for example, Bank of America, Verizon, T-Mobile, IBM, US Navy, Federal Aviation Administration, Department of Energy, Walmart, and Boeing.
After detecting unauthorized access, Red Hat immediately isolated the compromised instance, revoked the attackers’ access, contacted authorities, and applied additional security measures. The company initiated a detailed investigation and informed potentially affected customers.
Analysis of the leaked data demonstrated the risk of secondary attacks — particularly the possibility of lateral movement by attackers across customer infrastructures thanks to stolen tokens and other credentials. International agencies (e.g., Centre for Cybersecurity Belgium) labeled the incident as a threat to trust between consulting service providers and their clients.
Chinese Hackers Attack Through VMware Tools Vulnerability
A serious security vulnerability has been discovered in VMware Tools and VMware Aria Operations components. The vulnerability, tracked as CVE-2025–41244, allows an attacker with a regular user account on a virtual machine to gain root privileges through improper handling of binary files.
The flaw is located in the get-versions.sh script, which is part of the Service Discovery Management Pack (SDMP) in VMware Aria Operations. In an attempt to determine the version of various services such as httpd, nginx, MySQL, etc., the script uses overly generic regular expressions that allow an attacker to place their own malicious binary, for example, in /tmp/httpd. This binary is then automatically executed with elevated privileges without verifying its origin, allowing the attacker privilege escalation.
According to findings by security experts from NVISO Labs, the flaw is actively being exploited by the UNC5174 group, which Google Mandiant links to the Chinese state. This APT group is also responsible for attacks on Ivanti and SAP.
The vulnerability affects all major versions of VMware Tools for both Windows and Linux and selected VMware Aria Operations components. Therefore, thousands of enterprise infrastructures worldwide are affected.