How to prevent your WhatsApp account from being stolen: the update that stops it

Update iOS now and log out of WhatsApp to regain control: this is how the image exploitation that leverages CVE-2025-43300 and session cloning via CVE-2025-55177 is stopped. I give this direct response because it is the immediate measure that prevents the most likely damage: duplication of your session and sending spoofed messages.

A few minutes ago you received a photo and the phone became warmer than usual; afterwards your contacts received messages you did not send. This micro-story explains the modus operandi being seen in Spain: a manipulated DNG file that, when downloaded automatically, can trigger malicious code. There is a clear technical solution, but first you need to understand why it happens and how to identify it.

Source: official Apple notice published on August 20, 2025, and tweets by Manuel Guerra (@CiberPoliES) that have raised alerts about zero-click campaigns in Spanish territory.

What is happening and why does it affect you?

For the average reader, this matters because the attack does not require you to click or open any link: just the automatic download of an image can be enough. This makes any iPhone without one of the iOS versions with the corresponding patch vulnerable.

Which Devices Are Vulnerable?

If your iPhone does not have the iOS version mentioned below, it is potentially affected. The Apple notice points out that the vulnerability targets iPhones that process a manipulated image and generate a preview.

How does the technical attack work?

CVE-2025-43300 (image rendering flaw causing out-of-bounds write — code execution when processing malicious photos) is the entry point. This code is then exploited after a second flaw in WhatsApp’s device linking logic, identified as CVE-2025-55177, to duplicate the session and clone access without leaving the typical evidence that appears in the linked devices list.

This mechanism explains why many users do not see an additional device linked: the session is duplicated, not created from scratch.

How to check if it has happened to you?

This section matters because detecting it quickly prevents financial and identity losses. If you recognize any of the described signs, act immediately: every minute with the duplicated session facilitates fraud extension.

How to identify symptoms on the phone?

The main symptoms described by the source are: WhatsApp cuts and continuous reconnections, abnormal device heating, and messages sent to your contacts that you do not see as sent on your phone.

How to check active sessions?

Follow these steps to verify and close external sessions:

• Open WhatsApp on your iPhone.
• Go to Settings > Linked Devices and check the list.
• If you see unknown entries, tap Log Out or Unlink to remove them.
• To check your iOS version: open Settings > General > Software Information and look at the “Version.” If it does not match a secure version, update.

Doing this check can be the difference between recovering your session and temporarily losing control.

How to fix it: immediate steps and why they work

Acting fast matters because exploitation is zero-click: the update closes the rendering vulnerability and reinstalling WhatsApp ends the duplicated session. This combination explains the full recovery described by the source.

What is the technical firewall of the update?

These iOS updates eliminate the possibility that a manipulated image causes an out-of-bounds write during image processing, so malicious code cannot execute when downloading the file.

What preventive measures to take?

Key steps to follow right now:

• Temporarily uninstall WhatsApp from the device to close the current session and evict possible intruders.
• Update iOS to one of the secure versions indicated: iOS 15.8.5, iOS 16.7.12, or iOS 18.6.2 (or higher than the one shown on your device).
• Reinstall WhatsApp and activate Two-Step Verification: WhatsApp > Settings > Account > Two-Step Verification.
• Do not share verification codes received by SMS or call with anyone.
• Call or meet with family members in person before sending money if requested via message.

Affected Versions Table

Checklist to confirm affectation

• WhatsApp cuts and continuous reconnections: probable session duplication.
• Abnormal device heating without intensive use: possible background code execution.
• Contacts receive messages you did not send and these messages do not appear as sent on your phone.
• If none of the above are met: less likely affected, but still check the iOS version.

If you confirm any signs, follow the update and reinstallation steps immediately. If necessary, change passwords and activate additional recovery measures with your service provider.

Prevention and maintenance tips: keep the operating system updated, activate two-step verification, periodically review linked sessions, and do not share access codes. Make regular backups and compress recovery actions (trusted contacts, passwords stored outside the device).

When to seek professional help: if you cannot recover the session after updating and reinstalling, or if you see suspicious activity with bank accounts or personal data, contact a trusted technician or Apple support. Keep screenshots and message logs as evidence.

While the technical solution is clear, the rest depends on quick action and caution in managing codes and contacts.

Final summary: update iOS, uninstall and reinstall WhatsApp to close sessions, activate two-step verification, and review linked sessions. These measures eliminate the exploit path and recover control of your account. Protect your digital identity with caution and constant updates.