WhatsApp Security Alert: Disable Auto-Downloads to Block Malicious Media Bug
In a recent security scare, WhatsApp users, particularly on Android, are being warned about a vulnerability that allows hackers to secretly download malicious media files to devices without any user interaction. Discovered by Google’s Project Zero team, this bug exploits the app’s automatic download feature in group chats, enabling cybercriminals to spread malware effortlessly.
The exploit works by having attackers create fake group chats and add victims along with at least one of their contacts. Once the group is formed, a corrupted media file—such as an image or video laced with malware—is sent and automatically saved to the victim’s phone, bypassing any need for clicks or approvals. This zero-click attack poses significant risks, including data theft, spyware installation, and further propagation of malicious content in targeted campaigns. While primarily affecting Android, the issue underscores broader concerns about auto-download settings across platforms.
View this post on Instagram
Meta, WhatsApp’s parent company, responded swiftly with a server-side patch on November 11, 2025, partially mitigating the problem, and a full fix is in development. However, experts from Malwarebytes and others urge users to take proactive steps. The key recommendation: disable automatic media downloads to prevent unsolicited files from landing on your device.
For Android users:
– Open WhatsApp and tap the three-dot menu > Settings.
– Navigate to Storage and Data > Media auto-download.
– Under “When using mobile data,” “When connected on Wi-Fi,” and “When roaming,” uncheck Photos, Audio, Videos, and Documents.
– Confirm each shows “No media.”
For iOS:
– Open WhatsApp > Settings > Storage and Data > Media Auto-Download.
– Set each media type to “Never” for mobile data and Wi-Fi.
Additionally, enable WhatsApp’s Advanced Privacy Mode under Settings > Privacy > Advanced to restrict media from unknown sources. Users should also update the app regularly, avoid joining unknown groups, and adjust privacy settings to limit who can add you to groups—set it to “My contacts” or exclude suspicious numbers.
This incident highlights the ongoing battle against mobile threats. By tweaking these settings, billions of WhatsApp users can significantly bolster their defenses against such exploits, ensuring safer communication in an increasingly digital world.