WhatsApp is rolling out new privacy settings designed to protect journalists, activists, and others facing targeted cyberattacks, the messaging platform announced Friday. The “Strict Account Settings” automatically enhance privacy options, going beyond standard end-to-end encryption to mitigate sophisticated hacking attempts.
The move comes amid growing concerns about the use of spyware to monitor individuals, particularly those critical of governments or involved in sensitive reporting. Recent investigations have revealed widespread targeting of journalists and activists across Europe via WhatsApp, using tools like the Paragon spyware. Meta, WhatsApp’s parent company, discovered attempts to hack approximately 90 individuals in late 2023, according to a statement released Friday.
The new settings, currently being rolled out gradually to users, include automatic blocking of media and files from unknown senders, hiding profile pictures and online status from unfamiliar contacts, and mandatory two-factor authentication. WhatsApp recommends that only users who believe they are at specific risk activate the settings, noting that standard privacy measures are sufficient for most.
“This is the latest example of why spyware companies must be held accountable for their unlawful actions,” a WhatsApp spokesperson said. “WhatsApp will continue to protect people’s ability to communicate privately.” The company has issued a cease and desist letter to Paragon Solutions, the Israeli spyware firm linked to the recent hacking attempts, and is exploring legal options.
The attacks reportedly involved luring targets into WhatsApp groups and then sending malicious PDF files designed to infiltrate their devices. Experts describe this as a “zero-click” attack, meaning users did not need to click on a link to become infected. Similar techniques were used in the past with the Pegasus spyware, which compromised over 1,400 devices.
WhatsApp has informed the approximately 100 targeted users of the potential compromise, but has not disclosed their identities or locations. The platform disrupted the attacks in December, though the duration of potential compromise remains unclear.
Beyond the new “Strict Account Settings,” WhatsApp offers additional privacy tools, including chat locking, protected IP addresses to mask location during calls, a privacy checkup guide, and disappearing messages. The core of WhatsApp’s security remains its standard end-to-end encryption, which ensures that only the sender and receiver can read messages.
The development follows reports in Italy and Austria detailing the use of Paragon spyware to monitor journalists and activists. Investigations are underway to determine the extent of the surveillance and identify those responsible. The European Parliament is considering a call for an investigation into the matter, according to reports from Italy.
Paragon Solutions recently secured a $2 million contract with U.S. Immigration and Customs Enforcement (ICE) to provide a “fully configured proprietary solution,” according to Wired. The company has not yet responded to allegations from WhatsApp.
