WhatsApp Zero-Day Deep Dive: How the Silent Zero-Click Attack on iPhones Worked

Anatomy of an Attack: How Do You Take Over a Phone Without a Single Click?

In cybersecurity, zero-click attacks are the holy grail for attackers. They allow an attacker to fully compromise a device without the victim doing anything at all. If you want to better understand zero-day vulnerabilities, read our comprehensive guide to zero-day vulnerabilities. The recently patched WhatsApp vulnerability (CVE-2025-55177) is a textbook example of this kind of sophisticated threat. Let's take a closer look at how it worked.

Step 1: Exploiting Trust Through a Flaw in WhatsApp Sync

It all started with CVE-2025-55177 in WhatsApp itself. The problem was in the device synchronization protocol, the feature that lets users switch smoothly between their phone and the desktop app. Attackers found they could send a specially crafted, malicious sync message to a victim. Because of an authorization flaw, the WhatsApp app on the victim's phone accepted the message without question and tried to process content (for example, download data) from any URL the attacker chose.

This was the first and most important step. The attackers had a foot in the door and could force the app to perform an unauthorized operation.

Step 2: Escalating the Attack by Breaking Through Apple's Defenses

Forcing WhatsApp to open a link isn't enough to take over an entire device. That's where a second zero-day vulnerability came in: CVE-2025-43300, buried deep in Apple's operating systems (iOS, macOS).

This flaw was in ImageIO, the component responsible for processing images. It was a classic out-of-bounds write bug. By sending a specially crafted file (in this case, most likely an image), an attacker could write data to a region of memory they should never be able to reach. This caused memory corruption, which in turn led to arbitrary code execution on the device with system privileges.

Together, these two vulnerabilities formed a powerful exploit chain:

1. The attacker sends a "silent" message to the victim's WhatsApp.
2. CVE-2025-55177 forces the app to download malicious content (for example, a specially crafted image) from the attacker's server.
3. Apple's system-level vulnerability CVE-2025-43300 is triggered when the device tries to process that image.
4. The attacker gains remote code execution, which lets them install spyware and take full control of the device.

We triggered WhatsApp 0-click on iOS/macOS/iPadOS.
CVE-2025-55177 arises from missing validation that the [Redacted] message originates from a linked device, enabling specially crafted DNG parsing that triggers CVE-2025-43300.
Analysis of Samsung CVE-2025-21043 is also ongoing. pic.twitter.com/idwZXqh5WK

— DARKNAVY (@DarkNavyOrg) September 28, 2025

Stage 1: WhatsApp Opens the Gates (CVE-2025-55177)

The first vulnerability is a classic logic flaw, not the kind of memory bug people usually picture when they think of hacking. Imagine an office building whose access control system lets a courier into any room because it wrongly assumes that anyone who got through the main gate is authorized everywhere.

• The problem: The flaw was in WhatsApp's device synchronization protocol. When you use WhatsApp on a computer, this feature keeps your messages identical to the ones on your phone. It turned out that the protocol didn't properly verify whether a sync command actually came from a linked device.
• The exploit: The attacker sent a specially crafted sync message to the victim's phone number. Because of the bug, the WhatsApp app on the victim's phone treated it as a legitimate command from a trusted device. The message contained one simple instruction: "download and process the file at this URL."
• The result: With no action from the victim, their phone connected to an attacker-controlled server and downloaded a malicious image file. On its own, this vulnerability wasn't catastrophic (CVSS 5.4, medium severity). But it was the perfect silent mail carrier, delivering a digital bomb right to the victim's doorstep.

Stage 2: Two Bytes That Brought Down the Wall (CVE-2025-43300)

Once the malicious image was on the device, a second and far more powerful vulnerability came into play. This one sat at the very heart of Apple's operating systems, in ImageIO, the component that handles almost every image on the device.

• The problem: This was an out-of-bounds write bug. Picture a painter who is handed a canvas of a fixed size but keeps painting far beyond its edges, damaging the wall behind it. The bug was triggered when the system processed a specially crafted DNG file (Adobe's Digital Negative format).
• The exploit (the two-byte trick): The attackers made a tiny but critical change to the DNG file. Think of the file as a set of building instructions. In one place (the TIFF metadata), they changed the information to tell the system: "reserve memory for an image with two color channels." In another place (the JPEG image data embedded in the file), they left the instruction: "I will now write data for just one channel."
• The result: When Apple's system began processing the file, it walked straight into the trap. It allocated a large block of memory (for two channels) but wrote data into it as if there were only one. This mismatch caused the data to spill outside the allocated area, overwriting other critical information in the device's memory. The attackers were able to steer this chaos, place their own code in the corrupted memory, and force the system to run it.

The Perfect Storm: Combining Forces

Combined, the two vulnerabilities created a seamless, fully automated kill chain against privacy:

1. Delivery: The attacker sends an invisible message to the victim's WhatsApp (exploiting CVE-2025-55177).
2. Download: The victim's phone automatically downloads a malicious image from the attacker's server.
3. Infection: Apple's operating system tries to process the image, triggering the ImageIO vulnerability (CVE-2025-43300) and executing the attacker's code.
4. Compromise: Spyware is installed on the device. Game over.

The whole process took seconds and ran in the background, with no notification and no trace the user could see.

Zero Clicks, 100% Control: Welcome to the Era of Zero-Click Attacks

This incident is a textbook example of a zero-click attack, the holy grail of digital espionage. Why is it so dangerous? Because it takes out the strongest and, at the same time, the weakest link in any security system: the human being.

In traditional attacks such as phishing, the attacker's success depends on a user making a mistake: clicking a bad link, opening a malicious attachment, or entering a password on a fake website. We can train people, teach them to be careful, and build their awareness.

Zero-click attacks make all of that irrelevant. The victim could be a cybersecurity expert or the most paranoid, careful person in the world. It doesn't matter. Infection happens automatically when their device processes the data it receives, whether that's a message, an image, or even a missed call.

This is a fundamental paradigm shift. The entire burden of defense moves from the user to the software developers. And in systems made up of millions of lines of code, finding even one tiny bug is only a matter of time for well-resourced attackers. That is why zero-click attacks are the gold standard for intelligence agencies and commercial spyware vendors. They guarantee success against even the best-protected targets.

Who Was Targeted? The Victimology of a Digital Hunt

Looking at who was targeted tells us more about the attackers' motives than any technical analysis could. This was not a mass campaign to steal credit card data from millions of people. It was a precise, surgical operation aimed at a very specific group: civil society.

The fewer than 200 identified targets were mainly journalists and human rights defenders. A victim profile like this works like a fingerprint, clearly pointing to a political motive. The attackers weren't after money. They wanted information that would allow them to:

• Silence journalists: Uncover their confidential sources, monitor investigations into corruption and abuse of power, and ultimately spread the kind of fear that leads to self-censorship.
• Neutralize activists: Surveil their work, map their networks of contacts, and gather compromising material that could be used for blackmail or in fabricated court cases.

The choice of targets shows that this advanced tool was not used to fight terrorism or organized crime, the standard defense offered by companies that sell this kind of technology. The real goal was to suppress dissent and undermine democratic oversight.

The Specter of Pegasus: Who Is Behind the Attack?

Officially, no one has claimed responsibility for the attack. However, all the evidence (the technical sophistication, the victim profile, and the nature of the operation) points to one of two possible culprits: the intelligence agency of a powerful state, or a client of a commercial spyware vendor such as the notorious Israeli firm NSO Group, maker of Pegasus.

NSO Group is just the best-known player in a shadowy but extremely lucrative market that could be described as "authoritarianism-as-a-service." These companies hire some of the world's best security researchers to find vulnerabilities like the ones in WhatsApp and Apple, then sell ready-made surveillance tools to governments around the world.

This business model creates a deliberate "attribution gap" that guarantees impunity.

• The vendor (such as NSO) builds the weapon but claims it has no control over how its clients use it.
• The government client carries out the attack but is protected by state secrecy and plausible deniability.

The result is serious human rights abuses carried out with cutting-edge digital weapons, and no one is held accountable. That is not a flaw in the system. It is the system's defining feature.

The Discovery: A Race Between Spies and Engineers

How was such an advanced attack discovered? It's a story straight out of digital counterintelligence. The vulnerability was identified by WhatsApp's internal security team. However, the key information about its active exploitation came from Amnesty International's Security Lab.

Amnesty's analysts, known for tracking commercial spyware, discovered that this exploit chain was being used in targeted attacks on members of civil society. They quietly notified both Apple and Meta, which gave both companies time to develop and release patches before the attackers could exploit the vulnerabilities at scale.

It's a strong example of how important collaboration between independent researchers and tech giants is in fighting the most serious cyber threats.