The zero-click attacks they are among the most dangerous and insidious. This is because thanks to these you can be attacked without taking any action (this is why they are called “zero-click”). It is precisely the absence of interaction on the victim’s part that makes zero-click attacks particularly difficult to recognise: in fact, there is not always a suspicious message to avoid clicking on or an obviously dangerous attachment. Recently, the Postal Police turned the spotlight on one new wave of these cyber attackswhich particularly concern i Apple devices with outdated versions of iOS and of theWhatsApp application. Sometimes these messages begin with incipits like «I need a huge favor, can you send me a bank transfer?». Let’s see what you should do if you come across such a message.
The appeal and advice of the Postal Police
The Postal Police, in an official statement, explained that «A new wave of WhatsApp account compromises was recently reported, characterized by methods attributable to so-called “zero-click” attacks» adding that «Once they gain access to the account, criminals can send messages posing as a known person, such as a family member or friend, and ask for money by pretending to be in an emergency situation».
These statements released by the Postal Police highlight a fact well. Not all communications that we receive on WhatsApp from known contacts are harmless. If a family member or friend has suffered a cyber attack and their account is compromised, cybercriminals could use their profile to propagate the attack. And if they were to exploit the technique we told you about in the opening lines of the article, i.e. the zero-click technique, things would become even more insidious: this is because, as mentioned before, it will not be necessary to click on any link to be lured in turn.
But then is it hopeless? Absolutely not. The vulnerability reported by the Police, which particularly affect Apple devices, have been already corrected from the Cupertino tech giant. This is good news, because it means that you are only vulnerable if you have an iPhone that has not been updated to the latest available version of the operating system. Keeping the WhatsApp app and operating system updated, therefore, should give you a reasonably safe night’s sleep.
How to protect your WhatsApp account from zero-click attacks
In addition to keeping software updated, there are others actions with which you can protect your WhatsApp account from the collateral consequences of zero-click attacks that may have been perpetrated against contacts in your address book. We list them below:
- do not make payments to anyoneunless before having verified the real identity of the person who made the request. And to establish who is behind a request, we said that it is not enough to simply verify that it comes from a WhatsApp contact rather than a foreign number. To do this check, call the contact in question or speak to them in person and inform him that you have received a request for money from his WhatsApp account;
- periodically check the “Connected devices” section of WhatsAppso as to identify suspicious accesses. You can do this by going to the section You > Connected devices and, if you encounter a suspicious login, tap the link name and then You go out;
- In the end, activate the main security settings available in WhatsAppsuch as two-step verification and passkey, limit the automatic download of content and attachments, and protect your device with biometric unlocking. All these security settings (and many more) can be activated by going to the section You > WhatsApp Account.
What to do if your account is already compromised
If you were to notice something suspicious and think that your WhatsApp account has been compromised, timeliness becomes essential to limit the damage as much as possible. Notify your contacts firstinviting them to ignore any messages asking for money that have started from your profile, and start the account recovery process. In addition to this, don’t forget to report the incident to the Postal Police, so as to receive all the necessary assistance.
