Zero-Click WhatsApp Account Takeover (CVE-2025-43300 + CVE-2025-55177) — Active Campaign Targeting iOS 16 Devices

The chain begins with CVE-2025-43300, an out-of-bounds write in Apple's ImageIO triggered by a crafted DNG image. Apple patched the flaw in August 2025, but iOS 16 devices (iPhone 8 through 14) never received the fix, leaving that base permanently open. The second link is CVE-2025-55177, a WhatsApp authorization bypass in linked-device synchronization messages present in versions below WhatsApp for iOS 2.25.21.73. Together the two vulnerabilities let an attacker exfiltrate cryptographic handshake material and bind a new WhatsApp client to the victim's account without registering any entry in the Linked Devices section, which is why affected users saw no suspicious linked devices even as their accounts sent fraudulent wire-transfer requests.

WhatsApp confirmed approximately 200 targeted victims over three months and called the campaign a highly selective and advanced operation. The exposure is not random: the profile locks to users still running iOS 16, a population that is both smaller and higher-value because they include journalists, executives, and security professionals who have not upgraded hardware. The absence of a dedicated iOS 16 patch from Apple means replacement, not patching, is the only remediation, which turns every unpatched iPhone 8 through 14 into an unfixable endpoint for anyone handling sensitive communications.

Defenders should replace any iOS 16 device immediately; there is no patch path. For users who cannot replace hardware, enable WhatsApp Two-Step Verification and Lockdown Mode, and treat any unexpected money request as potential account compromise. Hunt by inspecting for invisible linked-device sessions: if a user reports fraudulent messages but the Linked Devices list is clean, assume a CVE-2025-55177-style authorization bypass rather than a traditional linked-device hijack. Monitor WhatsApp client handshake telemetry and avoid replying within the same chat thread when a suspicious wire request arrives, since the attacker's invisible session may intercept the reply.

Watch for Apple releasing a backported iOS 16 security update, which would change the replacement calculus. Also watch for WhatsApp pushing a forced upgrade that raises the authorization barrier, and for any new telemetry from Forenser identifying additional victim profiles beyond the current iPhone 8 through 14, iOS 16 footprint.