NSO Group WhatsApp Social Engineering Attack — Detection and Defense Guide

---
title: Suspicious External Link Clicks from WhatsApp Web Process
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects WhatsApp Web or Desktop application launching browser processes with suspicious external URLs, potentially indicating social engineering click-through.
references:
  - https://attack.mitre.org/techniques/T1204/
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2026/06/01
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.user_execution
  - attack.t1204.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\WhatsApp.exe'
      - '\WhatsAppWeb.exe'
      - '\WhatsAppDesktop.exe'
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  filter_legitimate:
    CommandLine|contains:
      - 'whatsapp.com'
      - 'web.whatsapp.com'
      - 'facebook.com'
      - 'whatsapp.net'
  condition: selection and not filter_legitimate
falsepositives:
  - Users clicking legitimate links from trusted contacts (baseline required)
level: high
---
title: Suspicious Network Connections from Mobile WhatsApp to Non-WhatsApp Infrastructure
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects WhatsApp mobile application establishing connections to external domains not owned by Meta/Facebook, potentially indicating exploit delivery post-link-click.
references:
  - https://attack.mitre.org/techniques/T1071/
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2026/06/01
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.initial_access
  - attack.t1566.002
logsource:
  category: network_connection
  product: android
detection:
  selection:
    Image|endswith:
      - '/com.whatsapp'
      - '/com.whatsapp.w4b'
  filter_whatsapp_infra:
    DestinationHostname|contains:
      - 'whatsapp.com'
      - 'whatsapp.net'
      - 'facebook.com'
      - 'fbcdn.net'
      - 'meta.com'
  filter_cdn:
    DestinationHostname|contains:
      - '.cdn.'
      - 'cloudfront.net'
      - 'akamai.net'
  condition: selection and not 1 of filter_*
falsepositives:
  - Legitimate external link previews and media downloads
  - Verified business integrations
level: medium
---
title: Browser Launch with Unusual Command-Line Parameters Following WhatsApp Activity
id: 9b4e2d93-0f5c-4a8b-bd23-4f6e9a0b1234
status: experimental
description: Detects browser processes launched with suspicious URL patterns or command-line arguments shortly after WhatsApp activity, consistent with exploit chain initiation.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/06/01
tags:
  - attack.execution
  - attack.t1059.003
  - attack.user_execution
  - attack.t1204.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  selection_suspicious_url:
    CommandLine|contains:
      - 'http://'
      - 'https://'
    CommandLine|contains:
      - '?id='
      - '?ref='
      - '?token='
      - '?key='
      - '?session='
  filter_known_benign:
    CommandLine|contains:
      - 'google.com'
      - 'microsoft.com'
      - 'linkedin.com'
      - 'twitter.com'
      - 'youtube.com'
  timeframe: 30s
  condition: selection_browser and selection_suspicious_url and not filter_known_benign
falsepositives:
  - Legitimate application link redirections
  - Marketing campaign tracking URLs
level: medium

// Hunt for suspicious external link patterns from WhatsApp Web/Desktop
let TimeWindow = 1h;
let WhatsAppProcesses = dynamic(["WhatsApp.exe", "WhatsAppWeb.exe", "WhatsAppDesktop.exe"]);
let BrowserProcesses = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe"]);
let MetaDomains = dynamic(["whatsapp.com", "web.whatsapp.com", "facebook.com", "whatsapp.net", "meta.com"]);

DeviceProcessEvents
| where Timestamp > ago(TimeWindow)
| where InitiatingProcessFileName in~ WhatsAppProcesses
| where FileName in~ BrowserProcesses
| extend ProcessCommandLine = tostring(CommandLine)
| where ProcessCommandLine contains "http"
| where ProcessCommandLine !contains "whatsapp.com" 
  and ProcessCommandLine !contains "facebook.com" 
  and ProcessCommandLine !contains "whatsapp.net"
| extend Domain = extract(@"https?://([^/]+)", 1, ProcessCommandLine)
| where Domain !in~ MetaDomains
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, 
  ProcessCommandLine, Domain, SHA256, InitiatingProcessSHA256
| order by Timestamp desc


// Correlate WhatsApp activity with subsequent network connections to suspicious domains
let TimeWindow = 5m;
let SuspiciousTLDs = dynamic([".xyz", ".top", ".gq", ".tk", ".ml", ".cf", ".ga"]);

DeviceNetworkEvents
| where Timestamp > ago(TimeWindow)
| where InitiatingProcessFileName =~ "WhatsApp.exe" 
   or InitiatingProcessFileName =~ "WhatsAppDesktop.exe"
| where RemoteUrl !contains "whatsapp.com"
  and RemoteUrl !contains "facebook.com"
  and RemoteUrl !contains "fbcdn.net"
  and RemoteUrl !contains "meta.com"
  and RemoteUrl !contains "whatsapp.net"
| extend Domain = tostring(RemoteUrl)
| where isnotempty(Domain)
| where Domain has_any(SuspiciousTLDs) 
   or RemotePort in (80, 443, 8080) 
   or NetworkCommunicationDuration > 300000 // Long-lived connections suspicious for C2
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, RemoteUrl, 
  RemotePort, RemoteIP, LocalPort, NetworkCommunicationDuration
| order by Timestamp desc

-- Hunt for browser processes spawned by WhatsApp with external URLs
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, Parent.Pid as ParentPid, Parent.Name as ParentName
FROM pslist()
WHERE Parent.Name =~ "WhatsApp" OR Parent.Name =~ "WhatsApp.exe" OR Parent.Name =~ "WhatsAppDesktop.exe"
  AND (Name =~ "chrome.exe" OR Name =~ "msedge.exe" OR Name =~ "firefox.exe" OR Name =~ "brave.exe")
  AND CommandLine =~ "http"
  AND NOT CommandLine =~ "whatsapp.com"
  AND NOT CommandLine =~ "facebook.com"
  AND NOT CommandLine =~ "whatsapp.net"

-- Hunt for recent network connections from non-standard ports potentially related to exploit delivery
SELECT Fd, Family, Type, Laddr, Raddr, State, Pid, Startime
FROM netstat()
WHERE Raddr.Port NOT IN (80, 443, 5222, 5223, 5228)  -- Exclude common web/WhatsApp ports
  AND Pid IN (SELECT Pid FROM pslist() WHERE Name =~ "WhatsApp" OR Name =~ "WhatsApp.exe")
  AND Raddr.Addr NOT IN ("127.0.0.1", "::1")

-- Hunt for suspicious browser artifacts (downloads, cache) with recent modifications
SELECT FullPath, Size, Mtime, Atime, Mode
FROM glob(globs="/*/Downloads/*", root="/Users")
WHERE Mtime > now() - 1h
  AND (FullPath =~ ".exe" OR FullPath =~ ".dmg" OR FullPath =~ ".deb" OR FullPath =~ ".apk")

# WhatsApp Security Hardening and Compromise Check Script
# Run with administrative privileges

Write-Host "[+] Starting WhatsApp Security Hardening Assessment..." -ForegroundColor Cyan

# Check for running WhatsApp processes
$whatsappProcesses = Get-Process | Where-Object { $_.ProcessName -like "*WhatsApp*" }
if ($whatsappProcesses) {
    Write-Host "[!] Found running WhatsApp processes:" -ForegroundColor Yellow
    $whatsappProcesses | Select-Object Id, ProcessName, Path, StartTime | Format-Table
} else {
    Write-Host "[+] No WhatsApp processes currently running." -ForegroundColor Green
}

# Check for suspicious browser processes spawned from WhatsApp
Write-Host "`n[+] Checking for suspicious browser spawn patterns..." -ForegroundColor Cyan
$browserExes = @("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe")
$parentWhatsApp = Get-CimInstance Win32_Process | Where-Object { 
    $browserExes -contains $_.Name -and 
    (Get-CimInstance Win32_Process -Filter "ProcessId = $($_.ParentProcessId)").Name -like "*WhatsApp*"
}

if ($parentWhatsApp) {
    Write-Host "[!] WARNING: Found browser processes spawned from WhatsApp:" -ForegroundColor Red
    $parentWhatsApp | ForEach-Object {
        $parentProc = Get-CimInstance Win32_Process -Filter "ProcessId = $($_.ParentProcessId)"
        Write-Host "  - Browser: $($_.Name) (PID: $($_.ProcessId)), Parent: $($parentProc.Name)" -ForegroundColor Red
        Write-Host "    Command Line: $($_.CommandLine)" -ForegroundColor Red
    }
} else {
    Write-Host "[+] No suspicious browser spawn patterns detected." -ForegroundColor Green
}

# Check recent network connections for suspicious external domains
Write-Host "`n[+] Checking recent network connections from WhatsApp..." -ForegroundColor Cyan
try {
    $connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | 
        Where-Object { $_.OwningProcess -in ($whatsappProcesses.Id) }
    
    if ($connections) {
        $suspiciousConnections = $connections | ForEach-Object {
            $process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
            $remoteHost = try { [System.Net.Dns]::GetHostEntry($_.RemoteAddress).HostName } catch { $_.RemoteAddress }
            [PSCustomObject]@{
                ProcessName = $process.ProcessName
                RemoteAddress = $_.RemoteAddress
                RemoteHostName = $remoteHost
                RemotePort = $_.RemotePort
                State = $_.State
            }
        } | Where-Object { 
            $_.RemoteHostName -notmatch "(whatsapp|facebook|meta)\.com" -and
            $_.RemotePort -notin @(80, 443, 5222, 5223, 5228)
        }
        
        if ($suspiciousConnections) {
            Write-Host "[!] WARNING: Found suspicious network connections:" -ForegroundColor Red
            $suspiciousConnections | Format-Table
        } else {
            Write-Host "[+] No suspicious network connections detected." -ForegroundColor Green
        }
    }
} catch {
    Write-Host "[-] Could not retrieve network connection data." -ForegroundColor Gray
}

# Check for suspicious files in user download directories
Write-Host "`n[+] Checking for suspicious downloads in the last 24 hours..." -ForegroundColor Cyan
$recentDownloads = Get-ChildItem -Path "$env:USERPROFILE\Downloads" -Recurse -File -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) -and 
                 $_.Extension -match "(exe|msi|js|vbs|ps1|bat|cmd|hta|zip|rar|dmg|pkg|deb|apk)" }

if ($recentDownloads) {
    Write-Host "[!] Found recently downloaded executable files:" -ForegroundColor Yellow
    $recentDownloads | Select-Object FullName, LastWriteTime, Length | Format-Table
} else {
    Write-Host "[+] No suspicious recent downloads found." -ForegroundColor Green
}

# Hardening Recommendations
Write-Host "`n[+] Hardening Recommendations:" -ForegroundColor Cyan
Write-Host "  1. Enable WhatsApp Two-Step Verification" -ForegroundColor White
Write-Host "  2. Configure WhatsApp Privacy Settings to limit profile visibility" -ForegroundColor White
Write-Host "  3. Review and block unknown/suspicious contacts" -ForegroundColor White
Write-Host "  4. Enable link preview warnings in WhatsApp settings" -ForegroundColor White
Write-Host "  5. Implement network-based filtering for known NSO Group infrastructure" -ForegroundColor White
Write-Host "  6. Deploy mobile threat defense (MTD) solutions on managed devices" -ForegroundColor White
Write-Host "  7. Enable browser exploit protection (SmartScreen, Safe Browsing)" -ForegroundColor White

Write-Host "`n[+] Assessment complete." -ForegroundColor Green