According to a security alert issued by the Italian Polizia di Stato in August 2026, a new wave of zero-click WhatsApp account compromises is targeting unpatched Apple devices. Criminals exploit these vulnerabilities to hijack accounts without user interaction, subsequently impersonating victims to trick friends and family into transferring money under the guise of simulated emergencies.
How Zero-Click WhatsApp Exploits Target Apple Devices
The Polizia di Stato warns that these attacks are particularly dangerous because they can occur without the user clicking a malicious link or performing any interactive task. The vulnerabilities leverage unpatched versions of iOS and WhatsApp running on Apple hardware.
Attackers use the hijacked accounts to fabricate urgent financial crises, exploiting the inherent trust recipients place in messages coming from a familiar contact’s genuine phone number. According to the police advisory, Apple has already addressed these specific vulnerabilities through targeted software security updates, making timely system updates critical for defense.
Recommended Security Steps to Protect Messaging Accounts
Law enforcement authorities advise users to implement several protective measures immediately to secure their messaging apps and personal devices:
Verify Out-of-Band: Never transfer money or fulfill financial requests received via chat without verifying the requester’s identity through a separate channel, such as a direct phone call or an in-person check.
Update Software Promptly: Install the latest available security updates for both the iOS operating system and the WhatsApp application.
Audit Linked Devices: Regularly check the “Linked Devices” menu inside WhatsApp settings to review active sessions and immediately disconnect any unrecognized hardware or sessions.
Enable Two-Step Verification: Turn on two-factor authentication for WhatsApp as well as your Apple Account to prevent unauthorized access.
Secure Device Access: Protect the smartphone using a strong device passcode alongside biometric security features like Touch ID or Face ID.
Recovery Procedures Following an Account Compromise
If an account takeover occurs, immediate action can limit financial damage to friends and family. Victims must rapidly alert their network through alternate communication channels, warning contacts to ignore any ongoing or future requests for funds. Users should then follow standard in-app account recovery protocols provided by WhatsApp.
For formal reporting and further guidance, individuals can contact the Polizia Postale by filing an online report through the official Commissariato di PS online portal, according to the Polizia di Stato.
Keep reading