WhatsApp users urged to change one setting after hacking bug

WhatsApp users are being advised to switch off the app’s automatic media downloads after Google researchers disclosed a flaw that could allow malicious files to reach phones without a user clicking anything. 

Google’s Project Zero team said the issue affects WhatsApp on Android and can be exploited through newly created group chats. In the scenario described by researchers, an attacker adds a target to a new group, sends a booby-trapped media file and relies on WhatsApp’s default auto-download behavior to pull the file onto the device. 

Project Zero said the technique is most likely to be used in targeted attacks because it requires an attacker to know or guess at least one of the victim’s contacts. Meta, WhatsApp’s parent company, has made changes to address the issue and is working on a broader fix, according to reports cited by Malwarebytes. 

Security experts said users can reduce risk by disabling auto-download. On Android, that can be done by opening WhatsApp, going to Settings, then Storage and data, and under Media auto-download selecting each connection type, mobile data, Wi-Fi and roaming, and unchecking photos, audio, videos and documents. Keeping WhatsApp updated is also recommended.