How zero-click attacks evolved, why encrypted messaging does not eliminate endpoint risk, and what forensic evidence may reveal after suspected compromise.
By Claude Khoury, Chief Operating Officer, NSI Global
ORIGINAL PUBLICATION: 14 May 2019 SUBSTANTIVELY UPDATED: 2 October 2026
In May 2019, WhatsApp disclosed a vulnerability in its calling functionality that had been exploited to deliver sophisticated spyware to selected mobile devices. Unlike conventional phishing, the target did not need to click a malicious link or even answer the call.
WhatsApp later said approximately 1,400 users had been targeted through the campaign. Amnesty International reported that human-rights defenders were among those targeted and that the exploit was associated with technology developed by NSO Group. Importantly, being targeted did not necessarily mean a device was successfully compromised: the exploit was not always reliable, and WhatsApp patched the specific vulnerability in May 2019.
The historical exploit is no longer active. The wider problem is. Since 2019, commercial spyware vendors have continued to look for new ways to reach mobile devices through messaging applications, browsers, operating systems and other components. In 2025, WhatsApp identified and mitigated another zero-click pathway, this time associated with Paragon Solutions’ Graphite spyware. In 2026, WhatsApp said it disrupted fresh NSO-linked social-engineering activity.
The lesson is not that WhatsApp is inherently unsafe. It is that high-value communications platforms remain attractive infection vectors because a successful device compromise can bypass the protection users expect from an encrypted application.
What Happened in the 2019 WhatsApp Spyware Campaign?
The 2019 vulnerability affected code used by WhatsApp to establish voice and video calls. The attack initiated calls to a target device and attempted to exploit the vulnerable component while the application processed the call. The victim did not need to answer.
Amnesty International reported that successful infection could cause the application to crash and that attackers may have been able to remove evidence of the malicious calls from call logs. Failed attempts could leave missed calls from unfamiliar numbers. WhatsApp blocked the attack in May 2019 and released updates addressing the underlying flaw.
The significance of the incident was not simply that a messaging application had a software vulnerability. It demonstrated that sophisticated surveillance software could potentially reach a phone through background processing with little or no deliberate action by the person being targeted.
What Is a Zero-Click Spyware Attack?
A zero-click attack is an exploit chain that does not require the target to deliberately open an attachment, click a malicious link or approve an installation. Instead, it attempts to exploit code that processes data automatically when a message, call, image, notification or other input reaches the device.
One-Click Versus Zero-Click
| Attack Type | User Interaction | Typical Concept |
| One-click | Target must interact | A malicious link or attachment must be opened. |
| Zero-click | No deliberate interaction required | A vulnerable component processes attacker-controlled data automatically. |
Zero-click does not mean that every attempt is successful, that no artefacts can ever remain, or that the victim will never notice anything unusual. It describes the level of user interaction required for the exploit path, not a guarantee of invisible or permanent compromise.
Why the 2019 Case Became a Landmark Pegasus Incident
The 2019 WhatsApp campaign became one of the best-known examples of commercial spyware being delivered through a zero-click vector. WhatsApp later attributed the campaign to NSO Group technology and sued the company in the United States.
During the litigation, evidence about Pegasus capabilities became more public. Meta said the spyware was capable of collecting extensive information from a compromised device, including data available through installed applications, location information and communications, and could activate device sensors such as the microphone and camera. Those capabilities depend on the device, operating system, exploit chain and privileges obtained; they should not be treated as identical in every compromise.
The legal case also reinforced a broader point: WhatsApp itself was only one potential delivery route. A sophisticated spyware vendor can seek alternative vectors through browsers, operating systems, other messaging applications or social engineering when one pathway is closed.
The 2019 WhatsApp Exploit Is Patched. Commercial Spyware Is Not Gone.
WhatsApp blocked the attack in May 2019 and released updates addressing the specific calling vulnerability. There is no basis for presenting that exploit as a current WhatsApp vulnerability in 2026.
What remains current is the surveillance-for-hire ecosystem. Exploit developers continue to search for new weaknesses and new delivery mechanisms. That is why historical spyware cases are most useful when they are treated as evidence of an evolving threat model, not as warnings that an old vulnerability remains open indefinitely.
2025: Paragon Graphite and Another WhatsApp Zero-Click
In January 2025, WhatsApp notified approximately 90 accounts that it believed had been targeted with spyware associated with Paragon Solutions. Citizen Lab subsequently reported that information from its investigation into Paragon infrastructure helped WhatsApp identify, attribute and mitigate an active zero-click exploit.
Citizen Lab later conducted forensic analysis of Android phones belonging to people in Italy who had received WhatsApp notifications. The researchers reported clear indications that spyware had been loaded into WhatsApp and other applications on examined devices.
The significance of the Paragon case is not that the 2019 exploit returned. It did not. The significance is that, years later, a different spyware vendor was again able to use WhatsApp as part of a zero-click infection pathway until the activity was identified and mitigated.
2026: NSO-Linked Targeting Continued Through Social Engineering
In June 2026, WhatsApp said it had disrupted new targeting activity linked to NSO. This time the activity was not described as a repeat of the 2019 zero-click call exploit. WhatsApp said the attempts relied on spear-phishing and malicious links designed to move targets to external websites.
WhatsApp also said it was asking a US federal court to hold NSO in contempt of a permanent injunction that barred the company from targeting WhatsApp and its users. The distinction matters: the 2026 activity shows continuity in the commercial-spyware threat, but not continuity of the old 2019 technical vulnerability.
End-to-End Encryption Does Not Eliminate Endpoint Risk
WhatsApp messages and calls are protected by end-to-end encryption. That protection is important, but encryption addresses the communication channel between endpoints. It cannot by itself protect information after it has been decrypted and displayed on a compromised phone.
If spyware gains sufficient control of an endpoint, it may be able to access information available to the user on that device, observe activity, capture notifications, obtain credentials or use sensors. In that scenario, the attacker does not necessarily need to break the cryptography protecting the message in transit; the attacker targets the device that legitimately receives and decrypts the message.
For executives, lawyers, government personnel, journalists, activists and other high-risk users, that distinction is central to mobile security. Secure communications depend on both the encryption protocol and the security of the devices at each end.
What Does a WhatsApp or Apple Threat Notification Mean?
A credible threat notification should be treated seriously, but it must be interpreted accurately. A notification may indicate that a platform has identified activity consistent with sophisticated targeting. It does not automatically prove that the device was successfully infected, nor does it identify every action the operator may have taken.
The first objective should be to preserve what can still be established. Screenshots of the notification, timestamps, unusual messages, call records and relevant account information can become useful context. If legal, employment, regulatory or personal-safety consequences may follow, avoid making unnecessary changes before obtaining specialist advice.
What Should You Do if You Suspect Sophisticated Spyware?
- Do not dismiss a platform threat notification or assume that no visible symptoms means no targeting occurred.
- Use a separate trusted device for sensitive communications where practical.
- Preserve the notification, suspicious messages, call history and other contextual information before it changes.
- Avoid factory-resetting, reinstalling or aggressively cleaning the suspected device if evidence may be required.
- Seek specialist digital-forensic advice where compromise could have legal, corporate, national-security or personal-safety consequences.
- Consider the broader environment, including linked devices, Apple or Google accounts, cloud services, email, messaging sessions and authentication records.
- Apply current security updates once evidence-preservation requirements have been considered.
- For people who face elevated targeting risk, use platform hardening features such as Apple’s Lockdown Mode or WhatsApp’s stricter security settings where appropriate.
NSI Global’s Forensic Spyware & Malware Detection service focuses on preserving and examining devices and other relevant evidence where covert monitoring or advanced malware is suspected.
What Can a Forensic Examination Reveal?
A forensic examination may identify indicators of compromise, suspicious application artefacts, anomalous processes, exploit-related traces, unusual network or account activity, deleted records, configuration changes, persistence mechanisms or other evidence relevant to the suspected event.
The examination should also look beyond the handset itself. Depending on lawful authority and scope, evidence may exist in cloud accounts, linked messaging sessions, backups, authentication records, network logs, other devices, enterprise systems or account-notification records.
The objective is not merely to answer ‘is there spyware on the phone today?’ A stronger investigation asks what activity can be reconstructed, what evidence supports that reconstruction, what cannot be determined, and whether the available artefacts are consistent with targeting, attempted compromise or successful compromise.
Can Forensic Examination Always Detect Pegasus or Graphite?
No. No responsible forensic examiner should promise universal detection of sophisticated spyware.
Detection depends on the device model, operating-system version, spyware version, infection method, exploit chain, time elapsed, available logs and artefacts, whether the device has been reset or updated, the extraction method and whether relevant activity occurred outside the device being examined.
Some spyware is specifically designed to minimise evidence, and some artefacts disappear naturally over time. A clean result therefore means that no relevant evidence was identified within the scope and limitations of the examination; it does not prove that the device was never targeted or monitored.
For a broader discussion of these limitations, see NSI Global’s Imminent Monitor Spyware: Safety and Evidence analysis.
Who Faces the Highest Risk From Commercial Spyware?
Most WhatsApp users will never be targeted by mercenary spyware. These tools are expensive, technically sophisticated and generally used selectively. Higher-risk groups can include government officials, defence and security personnel, diplomats, journalists, lawyers, executives, political figures, human-rights defenders and people connected to matters of strategic or intelligence interest.
Risk is also contextual. A person may become valuable because of who they communicate with, what negotiations they are involved in, which organisation they work for, the information on their device or their relationship to a more obvious target.
For organisations, this means mobile-device risk should be assessed alongside executive protection, travel security, privileged communications, insider risk and counterintelligence—not treated solely as an IT helpdesk problem.
Frequently Asked Questions
Can WhatsApp Be Hacked Without Answering a Call?
Historically, yes. The 2019 vulnerability allowed attackers to attempt exploitation through WhatsApp calling without the target answering. That specific vulnerability was patched in May 2019 and should not be presented as a current exploit.
Is the 2019 WhatsApp Pegasus Vulnerability Still Active?
No. WhatsApp blocked the attack and released updates addressing the flaw in May 2019. The continuing risk comes from new exploits, alternative infection vectors and social-engineering techniques—not from the old call vulnerability remaining permanently open.
What Is Zero-Click Spyware?
Zero-click spyware is delivered through an exploit chain that does not require the target to deliberately click a link, open an attachment or approve an installation. It usually targets code that automatically processes incoming data.
Does Zero-Click Mean the User Will See Nothing?
Not necessarily. Some attacks may leave no obvious warning, while others can produce crashes, unusual calls, notifications or forensic artefacts. Zero-click describes the lack of required user interaction, not guaranteed invisibility.
Can Pegasus Affect Android Phones as Well as iPhones?
Yes. Public evidence from the WhatsApp litigation and wider research shows that Pegasus has targeted both iOS and Android devices. The available exploit chains and forensic artefacts differ by platform and version.
What Is Paragon Graphite?
Graphite is commercial spyware sold by Paragon Solutions. In 2025, WhatsApp said it had identified and mitigated a zero-click exploit associated with Paragon, while Citizen Lab reported forensic evidence from Android devices belonging to notified targets.
Can a Forensic Examination Detect Spyware?
Sometimes. Forensic analysis can identify malware, indicators of compromise and suspicious artefacts when sufficient evidence remains available. Detection is not guaranteed, particularly with sophisticated spyware designed to minimise traces.
Should I Factory-Reset a Phone if I Suspect Pegasus?
Not if evidence may be important. A reset can alter or destroy forensic artefacts. Where legal, corporate or personal-safety consequences may follow, obtain advice before changing the suspected device. Immediate personal safety takes priority where a person is at risk.
Why the WhatsApp Cases Still Matter
The 2019 WhatsApp exploit is no longer a live vulnerability, but the case remains important because it exposed a fundamental feature of modern mobile surveillance: the weakest point may not be the encrypted message itself. It may be the endpoint, the application processing incoming data, the operating system or the person being induced to open a malicious link.
The Paragon case in 2025 and NSO-linked activity disrupted by WhatsApp in 2026 show how the delivery methods continue to evolve. Defenders should therefore avoid fighting the last exploit. The objective is to reduce exposure, maintain current software, harden high-risk devices, preserve evidence when targeting is suspected and use forensic analysis to establish what the available evidence actually supports.
If you have received a sophisticated-spyware warning or believe a phone may have been targeted, contact NSI Global for a confidential consultation before avoidable changes are made to potential evidence.
Sources and Further Reading
- Amnesty International – NSO Group tools abused WhatsApp to target human rights defenders with invasive spyware
- Citizen Lab – A First Look at Paragon’s Proliferating Spyware Operations
- Meta / WhatsApp – Winning the Fight Against Spyware Merchant NSO
- Meta / WhatsApp – Fighting Spyware: An Update From WhatsApp
- NSI Global – Forensic Spyware & Malware Detection
- NSI Global – Digital Forensics & DFIR Services
- NSI Global – Imminent Monitor Spyware: Safety and Evidence
