Guardia Civil probes alleged WhatsApp takeovers on iPhones in Cantabria

On November 6, 2026, Applesfera reported that the Guardia Civil in Cantabria was investigating alleged WhatsApp account takeovers on iPhones. Applesfera said more than 20 complaints had been reported in the region and that the accounts were allegedly used to impersonate their owners and ask contacts for money, often through Bizum. The report described a suspected “zero-click” method, meaning the target allegedly did not need to interact with anything for the attack to occur.

What WhatsApp’s 2025 advisory says

WhatsApp’s 2025 security advisory describes CVE-2025-55177, a flaw in authorization for linked-device synchronization messages. It says an unrelated user could trigger a target device to process content from an arbitrary URL. The advisory lists these historical affected-version cutoffs:

WhatsApp assessed that CVE-2025-55177, combined with Apple’s CVE-2025-43300, “may have been exploited in a sophisticated attack against specific targeted users” (WhatsApp’s 2025 advisory). Those version cutoffs and that assessment belong to the advisory’s account of a targeted campaign.

WhatsApp’s version cutoffs are historical details tied to CVE-2025-55177 and the app named in each row.

What the separate Italian cases add

INCIBE-CERT described separate WhatsApp account-misuse cases identified in Italy during May 2026. The cases involved iPhones running various iOS 16 versions, from iPhone 8 through iPhone 14. INCIBE-CERT said digital-forensics firm Forenser treated the same CVE pair as a possible technical explanation for those incidents, rather than a confirmed attribution (INCIBE-CERT’s account). INCIBE-CERT also noted that the Italian cases had no unfamiliar devices in WhatsApp’s linked-device list.

The update advice Applesfera reported

In its November 6 article, Applesfera recommended installing available updates for both iOS and WhatsApp. The advice was published alongside its account of the Cantabria investigation; the historical app-version cutoffs above describe WhatsApp’s separate 2025 advisory.