WhatsApp is warning millions of iPhone users to update their devices immediately after uncovering a sophisticated spyware campaign that combined a vulnerability in the messaging app with a newly disclosed Apple operating system flaw.

In an urgent advisory, the Meta-owned service said the exploit — tracked as CVE-2025-55177 — may have enabled attackers to send malicious messages that compromised users’ devices and data without requiring any clicks. The flaw, paired with a separate iOS weakness identified as CVE-2025-43300, could have allowed hackers to process content from arbitrary URLs, opening the door to spyware installations and theft of private messages.

“Our investigation indicates that a malicious message may have been sent to you through WhatsApp and combined with other vulnerabilities in your device’s operating system to compromise your device and the data it contains, including messages,” WhatsApp wrote in notifications to users believed to have been targeted.

The zero-click nature of the attack — flagged by Amnesty International researcher Donncha Ó Cearbhaill — means victims could be infected without opening a link or taking any action, a tactic that security experts say mirrors government-grade spyware campaigns. Amnesty warned that civil society activists were among those hit.

While WhatsApp initially suggested the attack affected only iOS and macOS, Ó Cearbhaill said early evidence pointed to Android users also being impacted. He urged at-risk individuals to activate iOS “Lockdown Mode” or Android’s “Advanced Protection Mode.”

The company is pushing users to install its latest updates — v2.25.21.73 for iOS and v2.25.21.78 for Mac — and in some cases recommended a full factory reset.

The episode underscores the growing tempo of advanced cyber operations against consumer platforms. It comes as U.S. officials are tracking a wave of activity by groups like “Scattered Spider,” which the FBI says is expanding from targeting insurers and retailers to airlines by impersonating employees to gain network access.

(YWN World Headquarters – NYC)