According to a report by the Financial Times, a vulnerability in WhatsApp allowed hackers to insert Israeli spyware onto phones. The malicious code was developed by Israeli company NSO Group and was transmitted by calling users via WhatsApp on iOS and Android.
The malicious code can be transmitted even if the user does not answer the WhatsApp call, the report explains. In many cases, the call will disappear from call logs, so it is possible that users were victimized and did not realize it.
Many details about the vulnerability remain unclear, but the report suggests the flaw has been open for several weeks. In a statement, WhatsApp said:
“This attack has all the hallmarks of a private company known to work with governments and infect mobile phone operating systems,” the company said. “We have notified a number of human rights organizations to collectively warn citizens of these risks.”
According to the report, it is too early to estimate the number of phones targeted. WhatsApp is used by more than 1.5 billion users worldwide and is owned by Facebook.
WhatsApp disclosed the issue to the U.S. Department of Justice last week and began deploying code to its servers on Friday. Engineers developed a patch to fix the vulnerability.
NSO Group reportedly develops tools like Pegasus and markets them to governments around the world as a way to combat terrorism and crime. In a statement to the Financial Times, it said it “would not use its technology to target any person or organization for its own benefit.”
