Zero-click attacks are among the most dangerous and insidious. This is because thanks to these you can be attacked without taking any action (this is why they are called “zero-click”). It is precisely the absence of interaction on the victim’s part that makes zero-click attacks particularly difficult to recognise: in fact, there is not always a suspicious message to avoid clicking on or an obviously dangerous attachment. Recently, the Postal Police has turned the spotlight on a new wave of these cyber attacks, which particularly concern Apple devices with obsolete versions of iOS and the WhatsApp application. Sometimes these messages begin with incipits like «I need a huge favor, can you send me a bank transfer?». Let’s see what you should do if you come across such a message.
The appeal and advice of the Postal Police
The Postal Police, in an official statement, explained that «A new wave of WhatsApp account compromises was recently reported, characterized by methods attributable to so-called “zero-click” attacks» adding that «Once they gain access to the account, criminals can send messages posing as a known person, such as a family member or friend, and ask for money by pretending to be in an emergency situation».
These statements released by the Postal Police highlight a fact well. Not all communications we receive on WhatsApp from known contacts are harmless. If a family member or friend has suffered a cyber attack and their account is compromised, cybercriminals could use their profile to propagate the attack. And if they were to exploit the technique we told you about in the opening lines of the article, i.e. the zero-click technique, things would become even more insidious: this is because, as mentioned before, it will not be necessary to click on any link to be lured in turn.
But then is it hopeless? Absolutely not. The vulnerabilities reported by the Police, which particularly affect Apple devices, have already been corrected by the Cupertino tech giant. This is good news, because it means that you are only vulnerable if you have an iPhone that has not been updated to the latest available version of the operating system. Keeping the WhatsApp app and operating system updated, therefore, should give you a reasonably safe night’s sleep.
How to protect your WhatsApp account from zero-click attacks
In addition to keeping the software updated, there are other actions with which you can protect your WhatsApp account from the collateral consequences of zero-click attacks that may have been perpetrated against contacts in your address book. We list them below:
- do not make payments to anyone unless you have verified the real identity of the person making the request. And to establish who is behind a request, we said that it is not enough to simply verify that it comes from a WhatsApp contact rather than a foreign number. To do this check, call the contact in question or speak to him in person and inform him that you have received a request for money from his WhatsApp account;
- periodically check the “Connected devices” section of WhatsApp, so as to identify suspicious access. You can do this by going to the You > Connected devices section and, if you encounter a suspicious access, tap the name of the connection and then Exit;
- finally, activate the main security settings available in WhatsApp, such as two-step verification and passkey, limit the automatic download of content and attachments and protect the device via biometric unlocking. All these security settings (and many others) can be activated by going to the You > Account section of WhatsApp.
What to do if your account is already compromised
If you were to notice something suspicious and think that your WhatsApp account has been compromised, timeliness becomes essential to limit the damage as much as possible. First notify your contacts, inviting them to ignore any messages requesting money that have started from your profile, and start the account recovery procedure. In addition to this, don’t forget to report the incident to the Postal Police, so as to receive all the necessary assistance.
