A scam is currently circulating on WhatsApp that could be very dangerous for you. Users are receiving seemingly harmless messages—usually from unknown numbers without unique names—and those messages contain nothing more than a photo along with a question along the lines of “Is that you?” or “Do you know this person?”
It’s a clear attempt to get you to download and open the attached image. With WhatsApp, you first have to authorize the download of images, and that’s exactly what the scammers are after.
In fact, the file isn’t a picture of you or someone you know, but rather it’s been manipulated to deliver malware and open up ways for your smartphone, tablet, or PC to be hacked. Afterwards, the scammers can gain access to your private data and even use it to blackmail you.
How the image download scam works
The scammers are exploiting a vulnerability in WhatsApp that makes it possible to inject manipulated images or videos without being recognized as such by the app. They can gain access to the parsing process via the file preview that’s generated when an image is downloaded, and this process breaks files down into smaller packages that are needed for the processing of messages.
If code snippets containing malware are injected during this process, scammers can use that malware to gain access to target devices. You don’t see any of this happening because these processes run in the background while you’re opening the image.
What does this mean for you? Not only can your WhatsApp account be stolen, but your data on the device can also be intercepted and taken. You have to be careful of who you trust on WhatsApp.
How to not be a victim to this scam
Whenever you get unsolicited messages, always pay special attention to who’s sending the message and why. Unknown numbers often conceal scammers who message people at random and hope that someone will be careless enough to fall for their tricks. It’s best to block them.
Also, never open images or other files if you aren’t 100% sure of what they contain, if you don’t 100% trust the one sending them to you, and if it seems like they really want you to open them for some reason.
To play it extra safe, you should disable the automatic downloading of media, which you can do by navigating to Settings > Storage and data. Under Auto-download media, deselect all file types by unchecking the boxes (even if your Wi-Fi connection is active).
Last but not least, make sure you always install the latest WhatsApp updates. This fixes known security vulnerabilities, reducing the chance that a scammer can exploit flaws to trick you. It’s currently not know when WhatsApp will update to fix this particular vulnerability.
Further reading: WhatsApp is banning AI chatbots like ChatGPT soon
