Silent Whisper vulnerability exposes WhatsApp users to secret tracking

A new security flaw known as Silent Whisper puts billions of WhatsApp and Signal users at risk. Attackers can monitor activity without detection, leading to battery drain and revelation of daily routines. An expert has created a tool that exploits this vulnerability to spy on users undetected.

The Silent Whisper vulnerability targets messaging apps WhatsApp and Signal, enabling hackers to secretly profile user activity. This flaw allows attackers to track communications and movements without alerting victims, potentially draining device batteries and exposing personal routines.

According to security reports, the issue affects over three billion WhatsApp users worldwide. The vulnerability operates silently, making it nearly impossible for individuals to notice any intrusion. An expert in cybersecurity has developed a specialized tool that demonstrates the full extent of this threat, capable of spying on multiple users simultaneously without leaving traces.

This discovery highlights ongoing challenges in securing popular messaging platforms. While WhatsApp, owned by Meta, has not yet issued a specific response in the available information, the potential for widespread privacy breaches underscores the need for immediate patches and user awareness. The tool's creation serves as a proof-of-concept, urging developers to address such weaknesses proactively.

Experts emphasize that Silent Whisper exploits subtle protocol flaws in end-to-end encrypted services, turning a key privacy feature against users. As digital communication grows, vulnerabilities like this could erode trust in essential apps.

Makala yanayohusiana

Illustration of Defense Secretary Pete Hegseth using Signal app on personal phone for Yemen airstrike plans, faulted by Pentagon watchdog for policy violation.
Picha iliyoundwa na AI

Pentagon watchdog faults Hegseth over Signal use in Yemen strike planning

Imeripotiwa na AI Picha iliyoundwa na AI Imethibitishwa ukweli

A Pentagon inspector general review found that Defense Secretary Pete Hegseth violated Defense Department policy by using the Signal messaging app on his personal phone to share sensitive details of planned U.S. airstrikes in Yemen. The report concludes that, had the information been intercepted, it could have endangered U.S. servicemembers and the mission, while noting that Hegseth had the authority to declassify the material. The findings were provided to Congress this week and a redacted version is expected to be released publicly within days.

Security researchers, first reporting via TechRadar in December 2025, warn WhatsApp's 3 billion users of GhostPairing—a technique tricking victims into linking attackers' browsers to their accounts, enabling full access without breaching passwords or end-to-end encryption.

Imeripotiwa na AI

Hackers are targeting WhatsApp users with a new GhostPairing scam that allows full account access without cracking passwords or encryption safeguards. The scam bypasses traditional authentication methods, posing a significant risk to user privacy and security. Users are advised to check the Linked Devices section to detect any compromises.

Two groups linked to China are exploiting a newly discovered vulnerability in Cisco's email security products. The campaign involves zero-day attacks, highlighting ongoing cybersecurity risks. The issue was reported on December 19, 2025.

Imeripotiwa na AI

Moxie Marlinspike, the creator of the Signal messaging app, has introduced Confer, an open-source AI assistant designed to prioritize user privacy in conversations with large language models. The tool encrypts user data and interactions so that only account holders can access them, shielding them from platform operators, hackers, and law enforcement. This launch addresses growing concerns over data collection in AI platforms.

Researchers have attributed a failed cyberattack on Poland's electric grid to Russian state hackers, coinciding with the 10th anniversary of a similar assault on Ukraine. The wiper malware aimed to disrupt power distribution but did not succeed in knocking out electricity. Security firm ESET linked the incident to the notorious Sandworm group.

Imeripotiwa na AI

In this ongoing series on the SEC $14M Crypto Scam Charges, the U.S. Securities and Exchange Commission on December 19, 2025, charged seven entities with defrauding investors of over $14 million via fake WhatsApp groups, social media ads featuring deepfakes, AI-generated tips, and bogus trading platforms. No real trading occurred, and funds were laundered overseas. The agency also issued an investor alert on social media scams.

Jumatatu, 2. Mwezi wa pili 2026, 00:15:39

Report uncovers data leaks in android ai apps

Alhamisi, 29. Mwezi wa kwanza 2026, 21:58:58

Meta inajaribu vipengele vilivyo na malipo kwenye Instagram, Facebook na WhatsApp

Jumapili, 25. Mwezi wa kwanza 2026, 15:11:38

OpenAI users targeted by scam emails and vishing calls

Ijumaa, 23. Mwezi wa kwanza 2026, 02:03:13

Huge data leak exposes 149 million credentials without protection

Alhamisi, 15. Mwezi wa kwanza 2026, 04:11:19

Flaw in Google Fast Pair devices allows hackers to eavesdrop

Jumatano, 14. Mwezi wa kwanza 2026, 06:04:56

Hackers hijack LinkedIn comments to spread malware

Alhamisi, 1. Mwezi wa kwanza 2026, 11:23:01

Trust Wallet confirms second Shai-Hulud supply-chain attack

Jumanne, 16. Mwezi wa kumi na mbili 2025, 01:55:47

Google retires free dark web monitoring tool next year

Jumatano, 10. Mwezi wa kumi na mbili 2025, 08:16:59

Crypto's new rich seek privacy amid extortion threats

Jumatano, 10. Mwezi wa kumi na mbili 2025, 07:11:22

North Korean hackers exploit maximum severity React2Shell flaw

 

 

 

Tovuti hii inatumia vidakuzi

Tunatumia vidakuzi kwa uchambuzi ili kuboresha tovuti yetu. Soma sera ya faragha yetu kwa maelezo zaidi.
Kataa