WhatsApp is urging users to update to the latest version of the app after a vulnerability was recently discovered that allowed hackers to insert spyware onto users' phones through the app's phone calling feature.
The spyware was developed by Israeli cyber intelligence firm, NSO, according to the Financial Times, which first reported the vulnerability.
Attackers could transmit the malicious code to the victim's device by calling it and regardless of whether or not they answered the call, it would be automatically infected. These calls cannot be detected from incoming call logs.
WhatsApp said the vulnerability was discovered this month and that the company quickly addressed the issue within its own infrastructure. An update for the app was released on Monday, and the company is encouraging users to upgrade immediately.
The company has also notified US authorities about the vulnerability and published a “CVE notice,” an advisory to other cybersecurity experts, warning them of “common vulnerabilities and exposures.”
The vulnerability was used in an attempted attack on the phone of a UK-based lawyer on May 12, the Financial Times reported. The lawyer, who was not named, is involved in a lawsuit against NSO.
“The attack has all the hallmarks of a private company reportedly working with governments to deliver spyware by infecting mobile device operating systems,” WhatsApp said in a statement. “We have notified a number of human rights organizations to collectively warn citizens of these risks.”
NSO Group did not immediately comment on the incident, but the company said it was investigating the WhatsApp attacks.
“Under no circumstances will NSO participate in the targeting of its technology, which is operated exclusively by intelligence and law enforcement agencies,” NSO Group told the FT.
NSO is responsible for creating the Pegasus spyware and selling it to government intelligence agencies. The spyware’s capabilities are nearly limitless. Once installed on a phone, the software can extract all the data already on the device (text messages, contacts, GPS location, email, browser history, etc.), in addition to creating new data using the phone’s microphone and camera, according to a 2016 New York Times report.
WhatsApp has around 1.5 billion users worldwide. The messaging app uses end-to-end encryption, making it popular. Pegasus spyware does not affect or compromise the app's encryption.
