A pair of newly discovered zero-day vulnerabilities—CVE-2025-43300 in Apple’s ImageIO framework and CVE-2025-55177 in WhatsApp—have been confirmed as part of a sophisticated spyware campaign targeting both iPhone and Android users. Security researchers revealed that attackers chained these flaws together in seamless zero-click exploits, requiring no user interaction to compromise devices. The Apple vulnerability, which exploited flaws in how Digital Negative (DNG) files were processed, enabled arbitrary code execution, while the WhatsApp flaw allowed attackers to force devices to fetch malicious content from arbitrary URLs.
Amnesty International reports that these vulnerabilities were used against civil society members, journalists, and other high-value targets, echoing past spyware campaigns such as Pegasus’ infamous FORCEDENTRY and BLASTPASS exploits. Apple has labeled the attacks “extremely sophisticated” and confirmed that targeted individuals were specifically chosen. WhatsApp has patched the flaw, pushed updates across its platforms, and notified roughly 200 affected users.
The implications of these chained exploits are severe: attackers could potentially gain access to messages, calls, photos, microphones, cameras, and location data—all without the victim clicking a single link. This marks another escalation in the ongoing arms race between advanced spyware developers and the security defenses of major tech platforms.
Both Apple and WhatsApp urge immediate patching to the latest versions. Security experts also recommend enabling Apple’s Lockdown Mode or Android’s Advanced Protection Mode for those at heightened risk. As spyware continues to evolve with zero-click capabilities, civil society groups, journalists, and human rights defenders remain on the front lines of digital surveillance.
#AppleZeroDay #WhatsAppZeroDay #CVE202543300 #CVE202555177 #ZeroClickExploit #SpywareCampaign #Pegasus #NSOGroup #AmnestyInternational #iOSSecurity #AndroidSecurity #MobileSpyware #Cybersecurity
