Spyware crafted by an “advanced cyber actor” infected multiple targeted mobile phones through the popular WhatsApp communications program through in-app voice calls, the company said.
The malware was able to penetrate phones through missed calls alone via the app’s voice calling function, the spokesman for the Facebook subsidiary said. An unknown number of people were infected with the malware, which the company said it discovered in early May.
John Scott-Railton, a researcher with the internet watchdog Citizen Lab, called the hack “a very scary vulnerability”.
“There’s nothing a user could have done here, short of not having the app,” he said.
It was likely used to target specific targets such as journalists and lawyers. A fix was rolled out on Friday, and WhatsApp urged all users to update their apps as an added precaution.