WhatsApp patches zero-click flaw in targeted iOS/mac spyware campaign

WhatsApp has patched a critical vulnerability that was used in a targeted spyware campaign against users of Apple devices, the company said in a security advisory late last week. The flaw, tracked as CVE2025-55177, was a zeroclick bug in WhatsApp for iOS and Mac that, when paired with a separate Apple vulnerability, allowed attackers to deliver spyware to targeted iPhones and Macs without any action by the victim.

WhatsApp said the defect involved incomplete authorization of linked device synchronization messages, which could allow an unrelated user to trigger processing of content from an arbitrary URL on a target device. The company added that, in combination with an operating system level flaw in Apple software, tracked as CVE2025-43300, the chain may have been exploited in a sophisticated assault against specific targeted users. Apple described its fix as addressing a condition in which processing a malicious image file may result in memory corruption and said it was aware of a report that the issue may have been used against extremely sophisticated attacks on individuals.

WhatsApp said it has notified fewer than 200 users who it believes may have been affected. Amnesty...