WhatsApp Zero-Click Scam: The Invisible Threat That Drains Your Accounts

A highly effective hacking technique is currently hitting people who still use older smartphones. With no link to click and no file to open, cybercriminals take over WhatsApp accounts and extract money from the victims' relatives. Here is what this very real threat looks like, and how to protect yourself.

This article will also interest you: Hack a Facebook Account: The New Invisible Tactic (and How to Recover Your Account in 2027)

What is a zero-click attack?

A zero-click attack is a computer intrusion that requires no action from the victim. Unlike classic phishing scams, where the user has to click a malicious link, scan a QR code, or download an infected attachment, this technique exploits software vulnerabilities directly in order to take control of the device.

The principle is as simple as it is unsettling: the victim does not have to do anything to be hacked. They can keep using their phone as usual, with no idea that their WhatsApp account is in the hands of cybercriminals.

The method works by exploiting security flaws in outdated versions of operating systems and apps. The attackers need no human interaction. The attack runs in the background, completely out of the user's sight.

How does this scam actually work?

A chain of vulnerabilities

The scam relies on the combined exploitation of two critical vulnerabilities:

• A flaw in older versions of iOS, the iPhone operating system. This vulnerability lets an attacker run malicious code on the device.
• A security flaw in the WhatsApp app itself, which makes it possible to bypass the authentication and synchronization mechanisms for linked devices.

According to research by the Italian digital forensics firm Forenser, incidents in Italy in May 2026 were tied to two identified vulnerabilities: CVE-2025-43300, a flaw in Apple's ImageIO framework, and CVE-2025-55177, an insufficient-authorization flaw in WhatsApp's linked-device synchronization messages.

Apple and WhatsApp patched both flaws during 2025. Devices still running vulnerable versions of iOS 16 remain exposed.

Specific models are being targeted

Research shows that the devices involved are mainly iPhones from the 8 through the 14, all running a version of iOS 16. Spanish authorities have also found that the oldest models, such as the iPhone 8, iPhone 8 Plus, and iPhone X (all released in 2017), are especially vulnerable because they no longer receive the latest security updates.

How the criminals operate

Once they have access to the WhatsApp account, the attackers use a highly effective impersonation strategy:

1. WhatsApp Web login: the attackers connect to the web version of WhatsApp by abusing linked-device synchronization. The victim receives no notification.
2. Targeting relatives: the criminals scroll through the victim's recent conversations and identify the closest contacts, such as family and close friends.
3. Urgent money requests: they send fraudulent messages to those contacts while pretending to be the victim. They invent emergencies: a parcel that must be paid for on delivery, a new phone after a supposed breakage, or any other pretext that plays on emotion and personal ties.
4. Deleting the evidence: right after sending, they choose "Delete for me." Because the victim's phone and the attackers' device stay in sync, the messages vanish from the victim's screen instantly, while the recipients can still see them.

A potentially large haul

The sums requested by the scammers can reach 1,000 euros per transfer, according to Spain's national cybersecurity institute, Incibe. Some sources mention even larger amounts, sometimes above 1,000 dollars.

Where did this scam come from, and where is it spreading?

Origins and spread

The first documented cases of this attack were identified in Italy in May 2026. Forenser was the first to report the incidents, after users discovered that messages asking for wire transfers had been sent from their accounts to recent contacts.

The scam then spread to Spain, where the national cybersecurity institute, Incibe, issued an official alert. About fifty complaints were filed in the province of Huelva, in southern Spain.

An international threat

Cases have also been reported in Sri Lanka, where authorities warned of attacks targeting iPhones running versions of iOS older than iOS 16.7.12.

In France, documented cases are fewer, but the authorities are taking the threat very seriously. Italy's national police issued an official alert, urging users to follow a series of preventive steps.

Why is this attack so dangerous?

1. Total invisibility for the victim

The most worrying feature of this scam is that it stays invisible. The victim gets no notification, sees no suspicious message, and the phone keeps working normally. They can use WhatsApp as usual and chat with their contacts without ever realizing the account is compromised.

That invisibility is reinforced by "Delete for me." The fraudulent messages are erased from the victim's phone, but the recipients still see them. The victim can be the last person to learn that their account was hacked.

2. Blind trust from relatives

The people who receive the fraudulent messages get those requests from the usual number and the usual conversation of someone they know. They have no reason to be suspicious. The attackers exploit that natural trust between relatives to push people to send money quickly, without a thorough check.

3. Exploiting emotional urgency

The fraudulent messages play on psychological biases: urgency, fear, and empathy. By inventing distress (a stuck parcel, a broken phone), the attackers stop recipients from taking time to think. People act in the moment, under the pressure of emotion, without verifying the request through another channel.

4. Financial and personal damage

Beyond the money lost, this scam can do serious damage to relationships. Relatives who sent money feel betrayed, while the victim whose account was hacked may be blamed by their circle. Mutual trust is shaken.

How can you protect yourself?

Essential preventive steps

• Update your operating system and WhatsApp. This is the most important step. Make sure your iPhone is running at least iOS 16.7.12 and that WhatsApp is up to date. The security patches published by Apple and Meta fix the vulnerabilities the attackers exploit.
• Check linked devices. Open WhatsApp, go to Settings, then to Linked devices. If you see a device you do not recognize, log it out immediately. Research has shown that in some cases the attackers did not appear in this section, but checking regularly is still essential.
• Turn on two-step verification. This feature adds an extra PIN when your number is registered on a new device. It is an important layer of security against account takeover.
• Limit automatic downloads. Turn off automatic downloads of media and attachments in WhatsApp. That reduces the attack surface if malicious files are sent.
• Lock your phone. Use a passcode, Touch ID, or Face ID. That makes unauthorized physical access to your data harder.

What to do if you are a victim

If you suspect that your WhatsApp account has been hacked:

• Log out every linked device from WhatsApp settings.
• Warn your contacts immediately so they do not respond to requests for money.
• Change your password and turn on two-step verification.
• Report the incident to the relevant authorities (in France, the cybermalveillance.gouv.fr platform or a police station).
• If money was sent, contact your bank as soon as possible to try to stop the transfer.

Good reflexes for relatives

If you receive an unusual request for money on WhatsApp, even from someone close to you:

• Do not reply right away.
• Contact the person through another channel (a phone call, a text message, or another messaging app) to verify the request.
• Never transfer money without direct confirmation from the person concerned.
• Report the message as spam or a scam inside WhatsApp.

AI and security tools: limited allies

The role of updates

Software updates are your first line of defense. Apple and Meta regularly publish security patches that fix vulnerabilities as soon as they are discovered. The problem is that many people do not install those updates, whether for lack of storage, neglect, or because their device is no longer supported.

Apple's Lockdown Mode

For users at higher risk, such as journalists, activists, and public figures, Apple offers Lockdown Mode, which considerably strengthens device security by limiting certain features. It can be turned on from the iPhone settings.

Artificial intelligence: a help, not a solution

AI can help detect some attack patterns, but it cannot replace sound digital hygiene. Criminals constantly adapt their techniques, and AI models are not trained on illegal dark-web data. Human vigilance remains essential.

Conclusion: do not be the next victim

The WhatsApp zero-click scam is a worrying evolution in cybercrime. It shows that attackers no longer need the victim to take part for an attack to succeed. The technology is now sophisticated enough to silently exploit flaws in obsolete devices.

Against this threat, the only real protection is prevention: keep devices updated, turn on the security measures that are available, and stay alert to unusual requests, even when they appear to come from people you know.

Do not wait until you are a victim. Check the version of your operating system and your WhatsApp app now. If your device can no longer receive security updates, it may be time to consider replacing it. The security of your personal data, and of the people close to you, depends on it.