WhatsApp users are being urged to change one setting to protect against a bug that secretly downloads "malicious" media files to mobile phones.
A WhatsApp "vulnerability" was discovered recently by Google's Project Zero team, where a malicious media file is automatically being downloaded to users' phones.
Hackers create group chats on the app, and once a user accepts the invitation, the file is sent to their device without them even knowing it.
Malwarebytes adds: "The bug affects WhatsApp on Android and involves zero‑click media downloads in group chats.
"You can be attacked simply by being added to a group and having a malicious file sent to you."
WhatsApp launches new privacy protection feature
WhatsApp has now launched a new, lockdown-style feature called Strict Account Settings.
If you turn this feature on, it will lock certain account settings on the app to the most restrictive.
WhatsApp explained: "It will limit how your WhatsApp works in some ways, like blocking attachments and media from people not in your contacts."
How to turn on Strict Account Settings on WhatsApp
Strict Account Settings began rolling out on WhatsApp late last month.
To activate, head to settings, click privacy, then advanced. And that's it, easy as that.
WhatsApp added: "Strict Account Settings is one of many ways we’re working to protect you from the most sophisticated of cyber threats.
"We’ve also rolled out a programming language called Rust behind the scenes to help keep your photos, videos, and messages safe from things like spyware, so you can share and chat with confidence."
Your WhatsApp messages are private. We use the open-source Signal protocol to encrypt them.
• Encryption happens on your device
• Messages are encrypted before leaving your device
• Only the intended recipient has the keys to decrypt messages
• The…— WhatsApp (@WhatsApp) January 27, 2026
It continued: "At WhatsApp, we think you should be able to have a private conversation online, just like you would in-person.
"We will always defend that right to privacy for everyone."
RECOMMENDED READING:
- WhatsApp users warned they could be banned from the app for doing this one thing
- You could earn nearly £1k a month by watching Netflix and testing apps - see how
- UK broadband company closes as customers told to find new provider 'immediately'
Other ways to protect against 'malicious' WhatsApp bug
Another way to prevent unwanted files from being downloaded onto your phone via bugs on WhatsApp is to switch off auto-download (for media), according to Malwarebytes.
To do that, head to settings and click chats, then switch off 'Media visibility' (Android) or 'Save to Photos' (Apple iOS).
Share