Are foreign governments capable of hacking WhatsApp? Renewed fears amid Iran’s warning to citizens

Iranian officials have recently called on citizens to delete the messaging app WhatsApp from their phones, claiming—without offering evidence—that it collects user data to transmit to Israel.

In response, WhatsApp quickly denied the allegations in a statement to the Associated Press, saying it was concerned “these false reports will be an excuse for our services to be blocked at a time when people need them most.” The Meta-owned app emphasized it does not track users’ locations or access personal messages. Although WhatsApp offers strong privacy and encryption features, no system is entirely immune to breaches.

With roughly 3 billion users worldwide and continuing to grow, WhatsApp enables texting, calls, and media sharing over the internet. According to an article by The Conversation, the platform uses end-to-end encryption, ensuring that only the sender and receiver can read messages—WhatsApp itself cannot access them. This design provides strong protections for user privacy.

Globally, the United States is considered the most capable nation in cyber operations, a term referring to the skills and resources that enable digital defence, offense, and exploitation. But Israel is also recognized as a top-tier cyber power, ranking alongside countries like the UK, China, Russia, France, and Canada.

Israel has an established track record of complex cyber activities, including the well-known Stuxnet worm, which targeted Iran’s nuclear infrastructure over 15 years ago. Its elite cyber military unit, Unit 8200, is highly regarded for both offensive capabilities and technological innovation. Today, seven of the world’s top 10 cybersecurity firms have research and development centers in Israel, and the country's startups are often at the forefront of cyber tool development.

Israeli companies have been connected to WhatsApp breaches before. The most prominent case involves Pegasus spyware, developed by Israeli cyber firm NSO Group. In 2019, Pegasus exploited a WhatsApp vulnerability to hack around 1,400 users, including journalists, activists, and political figures. Just last month, a US federal court ordered NSO Group to pay nearly $170 million in damages to WhatsApp and Meta over the incident.

Attacks like this often rely on “spearphishing”—a highly targeted form of phishing. Unlike traditional phishing, which sends mass emails to thousands of people, spearphishing focuses on deceiving specific individuals. It usually involves messages crafted to appear as if from trusted contacts or organizations, tricking recipients into opening malicious links or files that install spyware. This can allow attackers full access to the device, including decrypted WhatsApp conversations.

A spearphishing message might, for example, impersonate a colleague urging the recipient to view an urgent document or reset a password. The link may lead to a fake login page or trigger a silent malware download.

To protect against such attacks, experts recommend being skeptical of unexpected messages that create urgency and avoiding clicking unknown links or downloading unfamiliar files. Hovering over a link (without clicking) will show the true destination—garbled URLs or unfamiliar domains are red flags. Additional security tips include enabling two-factor authentication, keeping apps and operating systems updated, and confirming unusual requests through trusted channels. Regular cybersecurity training is also valuable in helping users recognize and avoid targeted digital threats.

By Nazrin Sadigova