WhatsApp says 1 billion users now use passkeys, while stronger two-step verification and caller context add new layers of account protection. WhatsApp has reached a significant security milestone: more than one billion people now use passkeys to protect access to their accounts. At the same time, Meta is adding stronger two-step verification and more information about calls from people who aren’t in a user’s contacts. Passkeys let users sign back into WhatsApp with a fingerprint, Face ID or their device’s screen-lock code instead of relying on passwords, PINs or one-time codes. WhatsApp now also allows people who use both Android and iOS devices to add more than one passkey to the same account, which removes one of the practical limitations of the earlier implementation. “More than 1 billion people now use a passkey: A passkey lets you log back into WhatsApp with your fingerprint, face ID, or screen lock code. It’s the fastest and most secure way to verify it’s really you, with no codes or PINs.” reads the announcement published by WhatsApp. “More than a billion people have already set one up, and you can now add more than one passkey to your account if you use both Android and iOS devices. To get started, go to Settings > Account > Passkeys.” For people who move between platforms, the ability to register multiple passkeys should make account recovery less dependent on a single device. It is important to highlight that WhatsApp is moving account protection away from secrets that users have to remember or type. Passkeys rely on credentials stored on the device and protected by its existing biometric or screen-lock mechanism, which also makes phishing them much harder than a traditional password or verification code. WhatsApp is also changing its two-step verification system. Until now, the additional protection relied on a six-digit PIN. The company has now upgraded it to a full password that can be longer, use letters and numbers, and include special characters. “Two-step verification is an extra protection layer that helps prevent someone from taking over your account, even if they get hold of your one-time passcode.” continues the announcement. “Until now it was a six-digit PIN, we’ve now upgraded it to a full password: longer, alphanumeric, and even with special ch@racters to make it harder to guess. If you’ve been using “123456,” this is your sign to upgrade.” That’s a small interface change with a meaningful security consequence. A short numeric PIN has a limited number of possible combinations and encourages users to choose predictable values, while a longer password gives account owners a much stronger second factor. WhatsApp makes the point in unusually direct terms, even calling out the classic 123456 choice. If that’s still protecting an account, the app has just provided a fairly unambiguous hint. The change also addresses a specific account-takeover scenario. If an attacker manages to obtain a user’s one-time registration code, the additional password can still prevent the takeover from succeeding. The third change targets a different problem: social engineering. On Android, WhatsApp will now provide additional context when someone outside the user’s contacts calls. The information can include whether the number comes from another country and whether the caller shares any groups with the recipient. That gives users a little more information before they decide whether to answer. “When you get a call from someone not saved in your contacts, a little context can help you decide whether to pick up. On Android, you’ll now see more information about a non-contact caller, like whether the number is from a different country and if you have any groups in common.” concludes the announcement. “Scammers rely on urgency – now you can take a beat with some more info before answering.” It’s a simple addition, but it addresses a common weakness in fraud attempts: pressure. An unexpected call creates a sense of urgency, and attackers often use that moment to persuade someone to disclose information, click a link or continue the conversation on their terms. Giving the recipient more context doesn’t stop a scammer from calling. It gives the user a reason to pause before answering. Taken together, the three changes target different parts of the same account-security problem. Passkeys make authentication harder to steal, stronger two-step verification provides another barrier when a one-time code is compromised, and caller context gives users more information before a potentially suspicious interaction begins. The billion-user passkey figure is also worth watching beyond WhatsApp. It suggests that phishing-resistant authentication is no longer an experimental security feature limited to security-conscious users. At this scale, the challenge shifts from convincing people that passkeys are safer to making sure they understand when and how to use them. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, WhatsApp)
Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites. The technique was previously spotted in July by security researcher inf0stache, who found a 'china_airlines' npm package that used a fake Cloudflare verification page to redirect visitors to a malicious domain, and was also reported by IntelFusions. In a later report, OX Security discovered 24 npm packages containing the same malicious HTML page hosted on npm and various mirrors. However, unlike the typical npm supply-chain attacks we've seen lately, installing the packages does not infect a developer's computer with malware or infostealers. Instead, attackers use the npm registry as free storage for malicious HTML pages, which are then copied by mirroring platforms like UNPKG and npmmirror.
A newly uncovered phishing-as-a-service (PhaaS) platform called AnonyMousKIT automates the retrieval of codes used to unlock stolen Apple devices and disable the Activation Lock feature. The illegal service has been active since early 2024 and is powering a structured ecosystem that sells stolen iPhones, harvests Apple IDs, accesses iCloud backups, and Keychain credentials. Researchers at threat intelligence platform SOCRadar took advantage of the platform operator's use of bare relative paths to gather information on how the service works, its operators, and infrastructure. SOCRadar found that AnonyMousKIT is connected to 506 domains and is fueling a sprawling business with 168 storefront brands acting as resellers. The researchers recovered records of 200 calls made to victims between August 2025 and May 2026, using 55 distinct interaction transcripts handled by a voice AI agent operating under five personas.
Healthcare and services provider Nutex is investigating a data breach incident where an unauthorized third party exfiltrated information from company servers. The organization has disclosed the cyberattack in a filing with the U.S. Securities and Exchange Commission (SEC), noting that the stolen data includes details that may be private or confidential. “Based on preliminary findings from the Company’s ongoing investigation, the Company believes that certain information maintained on the Company’s servers was accessed and exfiltrated by an unauthorized third party, including some information that may be private and/or confidential,” Nutex says. Nutex Health is a for-profit healthcare company that operates 28 facilities across 12 states, including the Bayou City ER & Hospital in Texas and Green Bay ER & Hospital in Wisconsin.
WhatsApp has started rolling out several new account security features, including support for multiple passkeys and stronger two-step verification. While the instant messaging service already allowed users to add passkeys for secure logins via fingerprint, Face ID, or screen lock code, it now lets them create separate ones for each platform. "More than a billion people have already set one up, and you can now add more than one passkey to your account if you use both Android and iOS devices. To get started, go to Settings > Account > Passkeys," it said. WhatsApp has also updated its two-step verification security feature to allow alphanumeric passwords instead of six-digit PINs. "Until now it was a six-digit PIN, we've now upgraded it to a full password: longer, alphanumeric, and even with special ch@racters to make it harder to guess. If you've been using '123456,' this is your sign to upgrade," WhatsApp added.
Threat actors have already compromised over 270 Zimbra instances in remote code execution attacks targeting a high-severity Zimbra Collaboration Suite (ZCS) vulnerability. The ZCS email and collaboration suite is used by hundreds of millions of people and organizations, including thousands of businesses and hundreds of government agencies worldwide. Synacor patched the security flaw (tracked as CVE-2026-73570), which allows unauthenticated attackers to gain code execution remotely by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled, with the release of ZCS version 10.1.20 on July 20. CERT Polska, the Polish Computer Emergency Response Team (CERT), first flagged the vulnerability as targeted in the wild last Monday, when it also warned security teams to check their logs for suspicious activity, including the Zimbra service restarting unexpectedly, and for files created in the /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ folders by user zimbra over the last 30 days.
Explore Unit 42 research on AI-enabled malware. Learn how existing behavioral detection and endpoint analytics stop AI-authored code before execution. The post The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution appeared first on Unit 42.
The U.S. Department of the Treasury has announced fresh sanctions on Iranian cyber actors as part of what it called an "unprecedented, whole-of-government, economic campaign" against the nation and its enablers. "We are launching an economic onslaught against Iran's financial connections around the globe. Our objective is to sever every economic lifeline that sustains this tyrannical regime
Oasis Security has disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take unauthenticated control of the local Ollama instance serving an AI agent and plant hidden instructions inside the model itself. The findings were shared with The Hacker News ahead of publication, and the report says Oasis Security reported them to NVIDIA's Product Security Incident
Meta on Tuesday announced a set of WhatsApp account security features, including support for multiple passkeys to a single account to help users with both iOS and Android devices sign into their accounts using the phishing-resistant method. The tech giant said more than 1 billion people use a passkey to log into WhatsApp. Support for passkeys was first introduced in Android in October 2023,
Confirm this action.
Leaving now will discard your changes.