WhatsApp Security Vulnerabilities Exposed by Advisor's Alleged Leak

Alleged leaks of WhatsApp conversations attributed to Prime Minister's advisor Yonatan Urich have highlighted significant security vulnerabilities in the messaging app, despite its end-to-end encryption. The leaks, which first appeared on pirate websites and later in an Excel file shared with journalists, included exchanges with Sara and Yair Netanyahu. Urich has filed lawsuits against individuals who shared the content online. These alleged leaks follow a report that Urich developed an AI-powered communication monitoring tool for the Prime Minister, which scanned news sources and sent alerts to WhatsApp groups. The tool's code, reportedly left exposed online, contained access keys to these groups, and was removed after inquiry.

Security experts explain that while end-to-end encryption protects messages during transit, it does not safeguard data once it reaches a device or a connected service. Moshe Levy, co-founder and CTO at Levinity Cyber, stated that any "linked device" or authorized service views the messages in plain text, meaning the encryption itself was not breached. Instead, vulnerabilities arise from connecting sensitive accounts to external services, often through seemingly routine actions like granting AI tools access to files or using third-party services with account permissions.

Shai Nachum, CEO of CYGHT, pointed to risks associated with rapid development using AI tools, especially for services integrating with WhatsApp. Quickly generated code may contain security flaws, and access keys or passwords could be improperly stored or accidentally exposed in public repositories. Nadav Avital, AI & Application Security Field CTO at Imperva-Thales, noted security weaknesses found in AI development platforms like n8n and Dify, which could allow account takeovers and exposure of access keys. Imperva research also found that nearly 40% of analyzed APIs suffer from authentication and token management security risks.

Ron Strauber, VP of Product at Spikerz Security, identified three main risk areas: an open linked device, providing authentication codes to external services, and falling victim to phishing or malware. He emphasized that most breaches today stem from these points. Experts advise users to regularly check linked devices in WhatsApp settings, disconnect unfamiliar or unnecessary connections, avoid linking personal accounts to unknown third-party services or AI tools, and enable two-step verification. Developers should avoid storing API keys and tokens in code or public repositories, and revoke compromised keys immediately.