Your Gray Checkmarks in WhatsApp and Signal Reveal What You're Doing and Where You Are

Most of us assume that messaging apps like WhatsApp and Signal protect our privacy almost completely. After all, the words "end-to-end encryption" (E2EE) are reassuring. And while the content of our conversations really does stay unreadable to outsiders, metadata (information about how and when we use these apps) can leak out in large amounts.

New research from a team at the University of Vienna and SBA Research sheds new light on the risks of a feature everyone ignores: message delivery receipts. These are the familiar double gray checkmarks (or circles in Signal) that tell the sender a message has reached the recipient's device.

It turns out these harmless-looking technical notifications can be turned against us in an attack the researchers have named "Careless Whisper".

What Is "Careless Whisper"?

Most users know they can turn off "read receipts" (the blue checkmarks) so they don't feel pressured to reply right away. Delivery receipts, however, which confirm that the server has passed the message to the phone, cannot be disabled. They are a core part of the protocol and are needed to keep encryption keys consistent.

The researchers found a way to make a victim's phone send this kind of receipt "silently." Normally, when someone sends us a message, the phone vibrates or makes a sound, which alerts the victim that something is happening. But the researchers found flaws in how so-called control messages are handled. For example, an attacker can send a reaction (an emoji) to a message that doesn't exist, or send a modified message. The victim's app receives it, processes it and confirms it with a technical delivery report, but no notification ever appears on the screen.

This lets the attacker "ping" the victim's phone very often (as often as once per second) without ever being noticed.

What Can Gray Checkmarks Reveal?

By measuring the time between sending a ping and receiving the receipt (RTT, or Round Trip Time), a cybercriminal can build a disturbingly accurate profile of the victim's behavior. Here is what this side channel reveals:

1. Whether you're looking at your screen: When a smartphone is idle (screen off), the processor slows down and power-saving features put network processes to sleep. A response to a ping then takes longer (e.g., more than 1 second). When the user is actively using the phone (screen on), the response comes almost instantly. This means a stalker or an employer can know exactly when you're using your phone, even in the middle of the night.
2. Whether you're using the messaging app: The researchers could tell the difference between moments when the user had WhatsApp or Signal open and moments when they were using other features of the phone.
3. Location and connection type: Response times differ significantly depending on whether the victim is on home Wi-Fi or a cellular network (LTE/5G). A sudden change in the latency pattern can suggest that the person has left home or arrived at the office.
4. Tracking multiple devices: Both WhatsApp and Signal support multi-device mode. Each linked device (e.g., a laptop running WhatsApp Web) sends its own receipt. As a result, the attacker can see when you turn on your computer or close your laptop, and can even work out which operating system you use from the order in which the packets arrive.

The "Spooky Stranger" and Battery Drain

The worst news is who can carry out this attack. With WhatsApp and Signal, the attacker doesn't need to be in the victim's contact list. Knowing the phone number is enough. The researchers call this scenario "Spooky Stranger". It means that anyone who has your number can monitor your digital daily routine.

The attack can also be weaponized. By sending large volumes of "silent" packets that force the phone to keep processing cryptographic data, an attacker can severely degrade the performance of the victim's device. In tests, the researchers managed to drain the battery by 15–18% in just one hour and to consume more than 13 GB of data, which could be disastrous for people on limited data plans. The victim only sees a battery that is emptying fast and a phone that is heating up, with no idea they are under attack.

How Have the App Makers Responded?

The report is alarming because it affects billions of users. Of the three apps tested (WhatsApp, Signal and Threema), only Threema was resistant to the "Spooky Stranger" attack. By default it rejects certain packets from people outside the contact list and does not send receipts in the same way.

WhatsApp and Signal were notified of the flaws. Meta (WhatsApp's owner) acknowledged the report, but by the time the research paper was published (October/November 2024), the problem had not been fully fixed. Signal introduced some rate limiting, which makes battery-drain attacks harder, but user profiling is still possible at a lower sampling rate.

As users, we're in a difficult position. We can't turn off delivery receipts, and blocking numbers only helps after the fact, once we know who the attacker is (and here the attack is invisible). For now, we have to wait for security patches that add random delays to sending receipts, which would blur the precise timing measurements this attack depends on. For more on protecting your privacy in messaging apps, see our comprehensive guide to communication privacy.

Messaging app security: Remember that WhatsApp has been targeted by zero-day attacks before. The CVE-2025-55177 vulnerability allowed attackers to take over a device remotely with no user interaction.

Aleksander

Sources: Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers (Arxiv PDF)