A phone can have strong encryption on its messages and still lose them. The warnings published over the past year say much the same thing: attackers rarely break the encryption, they reach the device or the account that holds the conversation. This article looks at five routes into messaging apps, and grades the evidence for each. It is shorter than most in this series, because for several routes the evidence does not support more.
Why the app, not the encryption
An attacker who gets code running on a phone, or an extra device linked to an account, sees messages after they have been decrypted for the owner. That is the logic behind the November 2025 warning that the US cybersecurity agency CISA issued, as relayed by Bitdefender: attackers do not break Signal or WhatsApp encryption, they compromise the device or the account[S3].
Phones are also a more direct channel than email. In Verizon’s 2026 Data Breach Investigations Report, phone-centric phishing simulations by voice and text message drew a somewhat higher median click rate than email simulations, Help Net Security reported. The report’s authors said they struggled to find companies running such simulations, so the sample is small and uneven[S9].
Five routes, five levels of proof
Describe this figure
Five boxes pointing at a messaging app. Group add then a PDF: reported by researchers as relayed by press. Linked-device QR code: warning relayed by a security vendor. A call that needs no answer: demonstration with a single source. Link preview needing one tap: researcher report of medium severity. Animated sticker: disputed, with the vendor denying the claim.
A group invitation and a file. The most thoroughly documented case. According to press reports of Citizen Lab’s findings, attackers added a target to a WhatsApp group and then sent a PDF that triggered infection without a tap. WhatsApp fixed the problem on its servers, with no update to install and no CVE number, and said it had stopped a campaign attributed to Paragon that reached about 90 users in more than two dozen countries[S1]. In a separate August 2025 case, WhatsApp said a flaw in handling linked-device sync messages let an unrelated user make a phone process content from an arbitrary web address. Combined with an Apple image-handling flaw, it was used against a small number of people, reportedly dozens[S2].
A linked-device QR code. According to Bitdefender’s account of the CISA alert, attackers use fake QR codes that silently link the victim’s account to an attacker’s device. Google had earlier reported phishing of this kind against Signal’s linked-device feature, the same account says[S3]. The CISA alert itself was not opened for this article, so the detail is as relayed.
A call that needs no answer. Calif says it built, with AI assistance and in about two days, an exploit for WeChat that needs only an incoming call, and that its demonstration spread from account to account through contacts. Calif says it reported the flaw to the app’s maker, which it says has mitigated it for all users. There is no CVE, no version and no independent confirmation, and Calif’s technical claims rest on its own posts[S4].
A link preview. WhatsApp pulled web addresses from the preview fields of an Instagram Reel message without checking that they pointed to a trusted site. A researcher reproduced a one-tap path that exposed the phone’s network address, headers and user agent, but could not reproduce the zero-click path Meta’s wording implies. It is rated medium severity, and Meta reports no exploitation in the wild, Cyber Kendra said[S5].
An animated sticker. A researcher working with the Zero Day Initiative reported a critical zero-click flaw in how Telegram processes animated stickers on Android and Linux. Telegram formally denied that code execution through stickers is possible, saying stickers are checked on its servers. This is disputed and unverified[S6].
Our assessment: what the proof supports
Our reading is that only the first route has been confirmed by an independent forensic group, and even that comes to us through press accounts of its findings. The linked-device warning is real but is a social-engineering route, not a software flaw. The call-based demonstration is credible as a demonstration and nothing more. The preview case is a minor one. The sticker case is a dispute.
None of this means the routes are equally likely. It means the public record supports different statements for each. We do not say that any messaging app has a flaw attackers can use right now.
What the Lab is watching
Calif’s announcement of Hexacon demos listed one it calls "Signal 1-click" and an iMessage demo, and said all would be released "in due time"; it named no device, version or document type[S7]. Heise reported that the videos show entry points through iMessage and Signal, each triggered by a manipulated PDF the user has to open. Calif’s own pages do not say so[S8]. We watch for a write-up, a CVE or a vendor advisory. Until one exists, we treat this as an announced demonstration only.
What this means for examiners
For a phone’s owner: open the linked-devices list in each messaging app and remove any device you do not recognize; limit who can add you to groups and message you; keep the apps and the operating system updated.
How it reaches a phone and what it leaves: propagation is a message, a call or an invitation; the format is a file, a preview or a QR code; traces are the received file, the message record, the linked-device list and notifications, plus network sessions; and the phone’s retention limits what survives.
Our approach
How SectraTEK approaches this
A messaging route leaves ordinary traces before it leaves unusual ones. An examination can show the apps installed and how they were installed, and the background network activity of those apps and services. In iOS backups and in iOS and Android full file system extractions it can also list the documents and attachments recorded in the evidence with their types and the conversation they belong to. Browser records show visited sites, including pages opened from links. Crash and system logs show restarts and failures with the dates they cover.
The limits are plain. A flaw exploited without a tap may leave little, and an attacker or the system may remove the message. Linked-device lists and server-side changes live on the account, not always on the phone. A result with no findings means no known indicators were found in the evidence provided. It is not proof that a conversation was never reached. SectraTEK does not claim to detect any named exploit.
What we could not confirm
We could not confirm the CISA alert directly[S3], the WeChat demonstration beyond Calif’s own account, or any technical detail of the Hexacon demos. We omit device and version claims about them.
Sources
Facts about third parties are attributed to the publisher named in the sentence. Each marker such as [S1] opens its row here.
| Marker | Publisher and title | Published | Accessed | Address |
|---|---|---|---|---|
| [S1] | BleepingComputer (relaying Citizen Lab and WhatsApp statements) WhatsApp patched zero-day flaw used in Paragon spyware attacks | Address not listed | ||
| [S2] | Malwarebytes WhatsApp fixes vulnerability used in zero-click attacks | www.malwarebytes.com | ||
| [S3] | Bitdefender (relaying a CISA alert) State-backed spyware attacks are targeting Signal and WhatsApp users, CISA warns | www.bitdefender.com | ||
| [S4] | Calif WeWorm | blog.calif.io | ||
| [S5] | Cyber Kendra WhatsApp patches Instagram Reels URL flaw, CVE-2026-23866 | www.cyberkendra.com | ||
| [S6] | Security Affairs Alleged unpatched Telegram zero-day allows device takeover, but Telegram denies | securityaffairs.com | ||
| [S7] | Calif iPhone (Hexacon demo announcement) | blog.calif.io | ||
| [S8] | Heise Calif.io jailbreak: how the untethered tool cracks iOS 27.0.1 | www.heise.de | ||
| [S9] | Help Net Security Verizon 2026 Data Breach Investigations Report: phone-centric phishing simulations (via Help Net Security) | www.helpnetsecurity.com |
The sources were last read on . If a fact here changes, the correction carries its date.