Black Hat Asia 2026 | When 3.5 Billion Strangers Can Exploit Your WhatsApp Devices

WhatsApp evolved from a simple text-messaging app serving thousands of users in 2009 to the world's largest messaging platform with 3.5 billion users and 30+ complex message types, but its original "anyone can contact anyone" architecture remained unchanged. This creates a systemic security risk where users' attack surface grows linearly with both features and users.

In this talk, we will demonstrate how attackers abuse WhatsApp's unrestricted access architecture for attacks ranging from mundane spam to APT zero-click remote code execution exploits. We will present two novel attack classes responsibly disclosed to Meta: Class I attacks that exploit nonconsensual message delivery, and Class II attacks that violate user privacy by extracting metadata directly from WhatsApp servers. We'll reveal our new device fingerprinting techniques leveraging implementation side-channels in E2EE and messages, release an open source WhatsApp research tool demonstrating these attacks, and provide live exploitation demos against test accounts.

Moving to defenses, we will reveal why current mitigations fail because they treat individual symptoms rather than the architectural root cause, creating a perpetual whack-a-mole cycle where each new feature potentially introduces new vulnerability classes. To thoroughly solve this issue, we will present a viable architectural solution that dramatically reduces the attack surface while maintaining strong privacy guarantees. Most critically, this solution makes the attack surface fixed with respect to WhatsApp's expansion in users and features, transforming security from reactive patching to secure by default.

Tal Be'ery | CTO, Co-Founder, Zengo (acquired by eToro)

https://blackhat.com/asia-26/briefings/schedule/?#your-number-is-up-when-35-billion-strangers-can-exploit-your-whatsapp-devices-50455