All CosmicBytez Labs articles tagged #WhatsApp, across news, security advisories, how-to guides, and projects.
- News
Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Delivery Path
Researchers released a PoC for CVE-2026-86950, a CoreGraphics bug Apple patched after targeted attacks; WhatsApp's new PDF scans hint at the delivery path.
- News
101 Malicious npm Packages Hijack Developer WhatsApp Accounts via Baileys Library
OX Security found 101 npm packages abusing the Baileys WhatsApp library to silently enroll developers in scam channels, racking up 490,000 downloads.
- News
WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins
Meta announces WhatsApp support for multiple passkeys per account on iOS and Android, ending password reliance with phishing-resistant biometric auth.
- News
Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data
Researchers at Guardio disclosed a now-patched vulnerability chain in the Adobe Acrobat Chrome extension dubbed HermeticReader, which could allow...
- News
U.S. Offers $10 Million for Russian Hackers Targeting WhatsApp and Signal Users
The U.S. Department of State is offering up to $10 million through its Rewards for Justice program for information identifying members of UNC5792 and...
- News
WhatsApp Is Finally Getting Usernames to Help Keep Phone Numbers Private
WhatsApp has begun global rollout of optional usernames, allowing over 3 billion users to connect without sharing their phone numbers — closing a major...
- News
Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials
Ukraine's SSU and the FBI have exposed a sustained Russian intelligence campaign using fake support SMS messages to steal Signal, WhatsApp, and Telegram...
- News
WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool
Attackers are abusing compromised WhatsApp accounts to distribute malicious VBScript files disguised as financial documents, ultimately deploying a...
- Newsletter
June 23 Digest: FortiBleed, Klue/Salesforce Supply Chain, Squidbleed, GitHub Actions Fix
A Russian IAB harvests 110M credentials from FortiGate firewalls; the Icarus group drains hundreds of Salesforce orgs via Klue OAuth tokens; a 29-year-old...
- News
WhatsApp Phishing Attack Uses Fake Business Docs to Hack PCs
An active malware campaign is targeting WhatsApp users across multiple countries with deceptive messages pushing VBScript-based droppers disguised as...