Zero-Click WhatsApp Account Takeover on iOS 16 — Detection, Analysis, and Hardening Guide

---
title: WhatsApp Account Takeover - Abnormal Outbound Message Volume
id: 3f8d1c92-7e4b-4d23-8b45-1a2b3c4d5e6f
status: experimental
description: Detects suspiciously high volume of WhatsApp messages sent in short time window, indicating potential account takeover and fraudulent activity. This rule targets the attack behavior of unauthorized messages being sent from compromised accounts.
references:
  - https://securityaffairs.com/192627/security/zero-click-whatsapp-account-takeover-hits-iphone-users-running-ios-16-no-linked-devices-no-warning.html
author: Security Arsenal
date: 2024/11/18
tags:
  - attack.initial_access
  - attack.t1190
  - attack.credential_access
logsource:
  category: network_connection
  product: mobile_edr
detection:
  selection:
    Initiated: 'true'
    DestinationHostname|contains: '.whatsapp.net'
  timeframe: 5m
  condition: selection | count() > 50
falsepositives:
  - Legitimate bulk messaging from business accounts
  - Active group chat participation
level: high
---
title: WhatsApp Database Modification - Session Token Anomaly
id: 7a2e9c45-3f1d-4e67-bc89-0d1e2f3a4b5c
status: experimental
description: Detects unauthorized modification of WhatsApp ChatStorage.sqlite database, specifically changes to session tokens or authentication structures without corresponding user-initiated application restart. This indicates possible session hijacking in zero-click attacks.
references:
  - https://securityaffairs.com/192627/security/zero-click-whatsapp-account-takeover-hits-iphone-users-running-ios-16-no-linked-devices-no-warning.html
author: Security Arsenal
date: 2024/11/18
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.defense_evasion
logsource:
  category: file_change
  product: mobile_edr
detection:
  selection:
    TargetFilename|contains: '/ChatStorage.sqlite'
    TargetFilename|contains: '/whatsapp/'
    ChangeType:
      - 'modified'
      - 'data_modified'
  filter:
    ProcessName|contains: 'WhatsApp'
    UserInitiated: 'true'
  condition: selection and not filter
falsepositives:
  - Legitimate WhatsApp application updates
  - Database compaction during normal operation
level: critical
---
title: iOS WhatsApp Process Memory Anomaly - Code Injection Indicator
id: 9b4d2e67-5c8f-4a12-9e34-2f3a4b5c6d7e
status: experimental
description: Detects unusual memory allocation patterns within WhatsApp process on iOS, potentially indicating successful zero-click exploit and code injection. This rule targets the initial exploitation phase of the attack chain.
references:
  - https://securityaffairs.com/192627/security/zero-click-whatsapp-account-takeover-hits-iphone-users-running-ios-16-no-linked-devices-no-warning.html
author: Security Arsenal
date: 2024/11/18
tags:
  - attack.execution
  - attack.t1203
  - attack.initial_access
logsource:
  category: process_creation
  product: mobile_edr
detection:
  selection:
    Image|contains: '/WhatsApp.app/WhatsApp'
    IntegrityLevel:
      - 'untrusted'
      - 'suspicious'
  condition: selection
falsepositives:
  - Rare: Legitimate debugging by developers
level: critical

// Hunt for WhatsApp account takeover indicators
// Combines network telemetry, endpoint logs, and user behavior analytics
let TimeFrame = ago(7d);
let WhatsAppDomains = dynamic(['*.whatsapp.net', '*.whatsapp.com', '*.g.whatsapp.net']);

// Detect abnormal message volume from single endpoint
let AbnormalMessageVolume = 
    DeviceNetworkEvents
    | where Timestamp > TimeFrame
    | where RemoteUrl has_any (WhatsAppDomains)
    | where InitiatingProcessFileName =~ "WhatsApp"
    | where ActionType == "ConnectionSuccess"
    | summarize MessageCount = count() by DeviceId, DeviceName, bin(Timestamp, 5m)
    | where MessageCount > 50;

// Detect database modifications outside normal application lifecycle
let DatabaseModifications = 
    DeviceFileEvents
    | where Timestamp > TimeFrame
    | where FolderPath has "whatsapp" and FileName has "sqlite"
    | where ActionType == "FileModified"
    | where InitiatingProcessVersionInfoOriginalFileName !in ("WhatsApp", "WhatsAppDesktop")
    | project Timestamp, DeviceId, DeviceName, FileName, InitiatingProcessFileName, SHA256;

// Detect network patterns consistent with message spamming
let MessageSpamPattern = 
    DeviceNetworkEvents
    | where Timestamp > TimeFrame
    | where RemoteUrl has_any (WhatsAppDomains) and ActionType == "ConnectionSuccess"
    | where InitiatingProcessFileName =~ "WhatsApp"
    | summarize Count = count(), DistinctDestinations = dcount(RemoteUrl) by DeviceId, DeviceName, bin(Timestamp, 15m)
    | where Count > 100 and DistinctDestinations < 10;

// Combine all detection logic
union AbnormalMessageVolume, DatabaseModifications, MessageSpamPattern
| project Timestamp, DeviceId, DeviceName, DetectionType = case(
    isnotnull(MessageCount), "HighMessageVolume",
    isnotnull(FileName), "DatabaseModification",
    isnotnull(Count), "MessageSpamPattern",
    "Unknown"
), Details = pack_all()
| sort by Timestamp desc

-- Hunt for iOS WhatsApp account takeover indicators
-- Focus on database modifications, suspicious processes, and network anomalies

-- Check for recent modifications to WhatsApp SQLite databases
SELECT 
    FullPath,
    Mtime,
    Size,
    Mode.String AS FileMode,
    Sys.DetailedInfo.BUsername AS Owner
FROM glob(globs='/**/whatsapp/**/*.sqlite', accessor='auto')
WHERE Mtime > now() - 24h

-- Identify suspicious processes with WhatsApp handle
SELECT 
    Pid,
    Name,
    Exe,
    Username,
    Ctime,
    StartTime,
    Cmdline
FROM pslist()
WHERE Exe =~ 'WhatsApp'
   AND StartTime > now() - 24h

-- Check for unusual network connections from WhatsApp
SELECT 
    RemoteAddr,
    RemotePort,
    LocalAddr,
    LocalPort,
    State,
    Pid,
    Family.String AS Protocol,
    Uid.String AS User
FROM netstat()
WHERE RemotePort IN (443, 5222, 5223)  -- WhatsApp ports
   AND Pid IN (SELECT Pid FROM pslist() WHERE Exe =~ 'WhatsApp')

-- Identify evidence of session hijacking in WhatsApp preferences
SELECT 
    FullPath,
    Mtime,
    Size
FROM glob(globs='/**/Library/Preferences/net.whatsapp.WhatsApp.plist', accessor='auto')
WHERE Mtime > now() - 24h

#!/bin/bash
# iOS WhatsApp Account Takeover Remediation Script
# This script assists in securing iOS devices against zero-click WhatsApp attacks
# Note: Requires iOS device supervision via MDM or Apple Configurator for full enforcement

echo "[+] Starting iOS WhatsApp Security Hardening"

# Check iOS version (requires connected iOS device via idevice)
echo "[*] Checking iOS version..."
# iOS_VERSION=$(ideviceinfo -k ProductVersion)
# echo "Current iOS Version: $IOS_VERSION"

# Enforce minimum iOS version 16.6 (contains patches for related vulnerabilities)
echo "[*] Verifying iOS version meets minimum security requirements..."
echo "[!] Manual verification required: Ensure iOS is updated to 16.6 or later"
echo "    Settings > General > Software Update"

# Verify WhatsApp is updated to latest version
echo "[*] Checking WhatsApp application version..."
echo "[!] Manual verification required: Ensure WhatsApp is updated to latest version"
echo "    App Store > Updates > WhatsApp"

# Enable Two-Step Verification for WhatsApp (mitigates account takeover)
echo "[+] WhatsApp Security Configuration:" 
echo "    1. Open WhatsApp"
echo "    2. Go to Settings > Account > Two-step verification"
echo "    3. Enable and set a strong PIN"
echo "    4. Add email address for recovery"

# Check for unknown linked devices (even though this attack evades it)
echo "[*] Linked Device Check:"
echo "    WhatsApp > Settings > Linked Devices"
echo "    Review all devices and unlink any unrecognized"

# Recommend enabling Lock Screen security for WhatsApp
echo "[*] Screen Lock Configuration:"
echo "    WhatsApp > Settings > Privacy > Screen Lock"
echo "    Require FaceID/TouchID to open WhatsApp"

# Check for suspicious recent activity
echo "[*] Security Audit Checklist:"
echo "    1. Review sent messages for unknown content"
echo "    2. Check with contacts about unusual messages received"
echo "    3. Review privacy settings for who can add to groups"
echo "    4. Enable 'Who can see when I'm online' = 'Same as last seen'"

# If compromise is suspected, initiate account recovery
echo "[+] If compromise suspected, execute Account Recovery:"
echo "    1. Uninstall WhatsApp completely"
echo "    2. Reinstall from App Store"
echo "    3. Verify phone number (verify you have control of SMS)"
echo "    4. Enable Two-Step Verification immediately"
echo "    5. Review Security Notifications"

echo "[+] Remediation script completed."
echo "[!] Follow up with MDM enforcement for iOS 16.6+ deployment."