WhatsApp is warning millions of iPhone users to update their devices immediately after uncovering a sophisticated spyware campaign that combined a vulnerability in the messaging app with a newly disclosed Apple operating system flaw.

In an urgent advisory, the Meta-owned service said the exploit � tracked as CVE-2025-55177 � may have enabled attackers to send malicious messages that compromised users� devices and data without requiring any clicks. The flaw, paired with a separate iOS weakness identified as CVE-2025-43300, could have allowed hackers to process content from arbitrary URLs, opening the door to spyware installations and theft of private messages.

�Our investigation indicates that a malicious message may have been sent to you through WhatsApp and combined with other vulnerabilities in your device�s operating system to compromise your device and the data it contains, including messages,� WhatsApp wrote in notifications to users believed to have been targeted.

The zero-click nature of the attack � flagged by Amnesty International researcher Donncha � Cearbhaill � means victims could be infected without opening a link or taking any action, a tactic that security experts say mirrors government-grade spyware campaigns. Amnesty warned that civil society activists were among those hit.

While WhatsApp initially suggested the attack affected only iOS and macOS, � Cearbhaill said early evidence pointed to Android users also being impacted. He urged at-risk individuals to activate iOS �Lockdown Mode� or Android�s �Advanced Protection Mode.�

The company is pushing users to install its latest updates � v2.25.21.73 for iOS and v2.25.21.78 for Mac � and in some cases recommended a full factory reset.

The episode underscores the growing tempo of advanced cyber operations against consumer platforms. It comes as U.S. officials are tracking a wave of activity by groups like �Scattered Spider,� which the FBI says is expanding from targeting insurers and retailers to airlines by impersonating employees to gain network access.

(YWN World Headquarters – NYC)