Zero-Click WhatsApp Account Takeover Hits iPhone Users Running iOS 16. No Linked Devices, No Warning

Pierluigi Paganini
May 25, 2026

A zero-click attack targeting iPhones on iOS 16 hijacked WhatsApp accounts without linked devices, warnings, or user interaction.

There is a particular kind of security incident that is harder to explain than most: your WhatsApp account is sending messages you did not write, asking your contacts for money transfers, and when you check the “Linked Devices” section in the app, it shows nothing. No unauthorized sessions, no suspicious logins, no QR codes scanned by mistake. Just your phone, your account, and someone else apparently using it at the same time.

That is exactly what happened to multiple iPhone users in Italy over the past few weeks, and the forensic investigation that followed has uncovered what appears to be an active zero-click exploitation campaign targeting a specific combination of iOS version and WhatsApp client.

The cases were brought to the attention of the Italian digital forensics firm Forenser by users who had all experienced the same bizarre pattern: messages sent from their WhatsApp number to recent contacts requesting wire transfers, with no memory of having sent them and no trace of any linked device in the app’s settings. The firm’s analysis, published this week, reveals a technically sophisticated attack that exploits known vulnerabilities in iOS 16 to gain unauthorized access to WhatsApp sessions without requiring any user interaction.

What the victims saw

The common thread across all reported cases was striking in its consistency. Every affected user was running an iPhone, models ranging from iPhone 8 through iPhone 14, including X, XR, XS, 11, SE, 12, and 13 variants, with some version of iOS 16 installed. The attackers gained access to recent chat conversations and sent messages requesting money transfers, but appeared unable to see older or archived chats. Most importantly, none of the victims recalled doing anything that would have authorized a new device: no QR codes scanned, no verification codes shared, no pairing process completed.

That ruled out the standard “ghost pairing” social engineering technique where an attacker tricks a victim into scanning a malicious QR code. What remained was something more concerning: a zero-click compromise requiring no action from the victim at all.

The first technical clue came from forensic analysis of iOS unified logs and sysdiagnose data from a compromised device. As Forenser described it.

“Analyzing the logs from one of the forensic copies and the related sysdiagnose, it was possible to notice an anomaly in the logs generated by WhatsApp: a continuous sequence of ‘resync’ events, as if the application were continuously renegotiating the session with WhatsApp servers.” reads the analysis published by Forenser.”These are events not very common and present in unusual quantity, unless someone else is attempting in parallel to keep their own session active on the same account.”

That pattern, continuous session resynchronization, is the signature of two endpoints competing to maintain control over the same WhatsApp account. The legitimate phone and the attacker’s client were repeatedly re-authenticating with WhatsApp’s servers in a cycle, with neither side fully displacing the other. This explained why messages were being sent without the victim’s knowledge while the “Linked Devices” section remained empty: the attacker’s session was not registered as a linked device in the traditional sense.

The researchers pointed out that every single case involved iOS 16. That specificity led Forenser’s team to investigate known vulnerabilities in that version of Apple’s operating system, and they found a plausible culprit: CVE-2025-43300, potentially in combination with CVE-2025-55177.

The CVE-2025-43300 vulnerability is an out-of-bounds write issue that resides in the ImageIO framework. An attacker could exploit it to cause memory corruption when processing a malicious image. Apple addressed the flaw in August 2025, after it discovered it was actively exploited as a zero-day in attacks targeting iOS, iPadOS, and macOS.

CVE-2025-55177 is a WhatsApp-specific flaw on iOS and macOS that allowed parsing of content from arbitrary URLs via improperly authorized linked-device sync messages. According to the CVE description, iOS versions below 16.7.12 are vulnerable; versions matching those found on all the compromised devices analyzed by Forenser.

Supporting this theory, the unified logs from affected devices contained multiple errors generated by the image processing library, occurring at times consistent with when the WhatsApp account compromise took place.

Forenser’s team reproduced part of the attack scenario in a controlled lab environment using a test device running a vulnerable iOS version. The reproduction confirmed that an attacker who successfully exploits the vulnerability can extract cryptographic material needed for the WhatsApp session handshake directly from the compromised device. That material can then be used to instantiate a new WhatsApp client elsewhere, attached to the victim’s account, without triggering any visible notification on the victim’s phone or in the WhatsApp app itself.

“Starting from the compromised device, it is possible to exfiltrate the cryptographic material useful for the session initiation handshake, necessary to instantiate a new WhatsApp client elsewhere, but hooked to the victim’s account.” continues the report. “It is precisely in this phase that the continuous sequence of ‘resync’ in the logs is generated (found similarly in our lab tests): the legitimate phone and the attacker’s client contend for the session, cyclically re-authenticating on WhatsApp servers.”

This model matches exactly what was observed in the real-world cases: an account sending messages to recent contacts despite a complete absence of linked devices visible in the app settings.

Since this appears to be a zero-click attack, traditional user hygiene measures like “don’t click suspicious links” do not apply. The most effective mitigation is straightforward: update iOS to the latest available version. CVE-2025-43300 has been patched in releases beyond iOS 16, and every compromised device analyzed by Forenser was running an unpatched iOS 16 build.

For users who suspect their account is already compromised, Forenser’s observations suggest a few practical steps. Locking chats using WhatsApp’s built-in chat lock feature (which hides conversations behind a PIN or biometric authentication) appears to prevent attackers from reading or writing to those chats. Updating the WhatsApp app itself, or reinstalling it on a new device and completing a fresh authentication, seems effective at evicting the attacker’s session. And since all observed cases involved iOS 16, upgrading the operating system should remove the underlying conditions the attack relies on.

One important note for anyone receiving suspicious money requests via WhatsApp: do not reply in the same chat to verify whether the request is legitimate. The attacker may see your response before the legitimate account owner does. Call the person directly instead.

This incident is a reminder that zero-click exploits, once the domain of state-sponsored actors with significant resources, are increasingly appearing in financially motivated cybercrime. The combination of known CVEs, widely available technical documentation, and a large population of devices running unpatched iOS 16 creates conditions where sophisticated attacks become operationally feasible for a broader range of threat actors.

Forenser’s team is continuing to collect forensic images and analyze the attack model in greater detail. In the meantime, the operational recommendation is clear: if you are running iOS 16 on an iPhone, update to the latest patch immediately. The gap between vulnerability disclosure and active exploitation continues to shrink, and in this case, the exploitation window is already open.

In December, attackers were spotted exploiting WhatsApp’s device-linking feature to hijack accounts using pairing codes in a campaign dubbed GhostPairing, without requiring authentication.

Gen Digital first observed the GhostPairing campaign in Czechia, but the attacks spread globally via compromised accounts.

The attack chain begins with victims receiving a message, such as “Hey, I just found your photo!”, from a trusted contact. The message contains a link with a Facebook-style preview.

The links used in the attack led to fake Facebook lookalike domains, not real Facebook sites, using photo-related names and misleading login paths.

The link leads to a fake Facebook viewer that prompts users to “verify” to see the content. By following a short, seemingly harmless sequence of steps, victims unknowingly grant attackers full access to their WhatsApp accounts, without any password theft or SIM swap.

Clicking the WhatsApp link takes victims to a minimal fake Facebook page designed to build trust and prompt verification.

The page acts as a control layer, abusing WhatsApp Web rather than Facebook. Victims are shown either a QR code or, more often, a numeric code to enter in WhatsApp.

Attackers trick victims into entering the code to link a new device, a warning many users overlook.

By completing this step, users unknowingly link the attacker’s browser as a trusted device, giving full access to messages, photos, and account activity.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon