A WhatsApp vulnerability (in other words: a hack, security breach, intrusion, security flaw, eavesdropper app) was discovered in early May. It's a bad guy that allows phones that used the app's call feature to remotely install surveillance spyware onto owners of Android and iPhones, simply by calling someone on the phone. The spyware could be injected even if the call wasn’t answered. It makes call logs disappear from the target’s device, thereby erasing any evidence that their phone had ever been tampered with.
About 1.5 billion users are affected.
WhatsApp - a Facebook-owned company - is advising all users to update the app whether they have been affected or not, to ensure they have the proper protection against potential exploits that can access stored information on mobile devices.
The NSO Group is behind the spyware with their program called Pegasus. It allows operators to take control of a target's phone, to switch on a phone's camera and a microphone, and access and read private data.
The Pegasus spyware is usually licensed to governments who use it to gain access to the devices of people who are under investigation.
NSO Group said its technology is used by “authorized government agencies for the sole purpose of fighting crime and terror. The company does not operate the system, and after a rigorous licensing and vetting process, intelligence and law enforcement determine how to use the technology to support their public safety missions.”
AMNESTY INTERNATIONAL
Human rights organization Amnesty International filed legal action to revoke the NSO Group's export license in Israel after an Amnesty International staff member was targeted in August 2018 by Pegasus.
WhatsApp said it made changes last week to prevent the attack from happening again and issued an update for its app. They are advising their 1.5 billion users to update their devices.