The problem is that these tools, while offering better protection than SMS or unencrypted email , are not designed for the level of security required for high-value strategic communications. They tend to concentrate the infrastructure in a few of the provider’s data centers, creating single points of failure and prime targets for attackers and legal pressure from foreign governments. For communications, marketing, and PR professionals, these technical flaws translate into operational risks.
Confidential media strategies, embargoed press releases, and crisis response plans often flow through encrypted messaging apps. But as we’ve seen, the real risk often lies in how these tools are used, not how they’re built. Its open-source protocol is widely respected, and its encryption model has been adopted by other platforms, including WhatsApp. A recent NPR feature on vulnerabilities within Pentagon communications highlights just how fragile even highly secure Meetheage customer service systems can be when subjected to targeted attacks. Many of these applications fail to perform their intended function of anonymizing data, getting traffic with valuable metadata and authentication information redirected to unknown servers.
Unlike email phishing, SMS has a higher trust factor — users tend to open and read texts instantly. When deciding to develop messaging software, it is crucial to focus not only on its functions but also on its architecture. The program must enable communication via a closed and encrypted channel and should not request any potentially sensitive information, such as a phone number. This data can be exploited to identify particular users and reconstruct the communication trail if needed. The attack, detailed in recent research by cybersecurity firm DARKNAVY, exploits WeChat’s built-in browser components and URL parsing mechanisms to execute remote code without requiring any user interaction beyond receiving the message.
This chain of events effectively enables remote code execution (RCE) or content spoofing, which could be leveraged to drop payloads ranging from credential-stealing scripts to ransomware. When a user links their WhatsApp client on a new device, synchronization messages propagate chat histories and media over multiple endpoints. Several days after top national security officials accidentally included a reporter in a Signal chat about bombing Houthi sites in Yemen, a Pentagon-wide advisory warned against using the messaging app, even for unclassified information. It’s a good idea to review the privacy settings of each app to limit who can see your profile picture, description, last seen time, or public profile.
The good news for people who use Apple phones is that iMessage and FaceTime are also already end-to-end encrypted, says Hong. For Android phones, encryption is available in Google Messages if the senders and recipients all have the feature turned on. Enforce the vendor’s configuration guidance, ensuring that linked-device synchronization messages are permitted only from authenticated endpoints. Organizations and individual users are strongly urged to apply vendor-supplied mitigations by September 23, 2025, or to discontinue use until secure patches are available. True digital safety requires not just encryption, but also user awareness, platform transparency, and adaptive regulation. Each platform served a unique audience, but all became prime targets for cybercriminals due to their scale and sensitivity of stored data.
Attacks attributed to groups like Salt Typhoon against major telecommunications providers have highlighted the fragility of the communications infrastructure that underpins governments, businesses, and critical services. Faced with this sense of vulnerability, many organizations have turned, almost instinctively, to consumer messaging apps as a quick fix to “secure” internal communications. People install free apps on their phones and actively use them to gain access to blocked social networks and streaming services or other resources. According to security experts, many free VPNs sell user data to third parties, and nearly 20% fail to hide the user’s IP address. As IM apps integrate more features (payments, mini-programs), their attack surfaces expand, requiring stricter access controls and faster patch cycles.
“These are for legitimate wiretaps that have been authorized by the courts,” Hong says. But in hackers’ hands, he says, the tools could potentially be used “to surveil communications and metadata for lots of people. And it seems like the hackers’ focus is primarily Washington, D.C.” The FBI and CISA also advise users to set their phones to update operating systems automatically. In full end-to-end encryption, tech companies make a message decipherable only by its sender and receiver — not by anyone else, including the company.
However, it is crucial to recognize that even such programs may harbor vulnerabilities that may not be apparent to developers but are exceedingly convenient for attackers, particularly if DevSecOps principles were not employed. A security vulnerability has been discovered in the USB-C port controller fitted to the iPhone 15 and 16. However, exploiting it would be so complex that both Apple and the security researcher who discovered it concluded that it is not a real-world threat. This flaw affects the platform’s JSP (JavaServer Pages) application architecture, where heap content becomes accessible in a manner equivalent to traditional core dumps. CISA has issued an urgent warning regarding two critical vulnerabilities in TeleMessage TM SGNL that threat actors are currently exploiting in active attack campaigns. Because many Instant Message (IM) systems are not designed with security features, hackers have found it easy to plant viruses, spyware, phishing scams, spam over IM (spim), and a wide variety of worms.
In this post, we’ll explore the major data breaches that affected messaging apps between 2020 and 2024, analyze what went wrong, and extract lessons to build safer communication platforms — without sacrificing convenience. Another area where messaging apps have become a hunting ground for criminals is identity theft and phishing . Campaigns that were previously limited to email are now also distributed via SMS, WhatsApp, and other channels, with messages that pretend to be legitimate notifications to trick users into clicking where they shouldn’t.
The affected applications include hugely popular apps such as Facebook Messenger, Signal, Google Duo, JioChat, and Mocha. Despite being more than 30 years old, SMS (Short Message Service) is still one of the most widely used communication tools in the world. Billions of messages are sent every day for personal conversations, business notifications, and authentication codes. Finally, it’s important not to forget the role of messaging apps as a distribution channel for malicious files . MDM enables IT administrators to control and secure company data on employee devices.
However, end-user awareness campaigns remain critical, as smishing often bypasses technical defenses. Attackers can send SMS messages with forged sender IDs, making them look like they came from a bank, government agency, or trusted contact. Combined with smishing, this dramatically increases the success rate of phishing campaigns.
She plans to continue investigating similar issues that could reveal more problems. These trends turned messaging apps into critical digital infrastructure, making their protection as vital as corporate networks. Between 2020 and 2024, messaging apps evolved from casual chat tools into essential communication infrastructure. The COVID-19 pandemic accelerated this shift, with billions depending on these apps for work meetings, virtual classes, and even healthcare consultations. Messaging apps have become the backbone of modern communication — from birthday planning to boardroom discussions, and even customer support. Their convenience makes them indispensable, but it also introduces serious security risks.
The first is to treat phone numbers and codes received via SMS as sensitive credentials that should never be shared , even if the person requesting them appears to be a friend, a technician, or the app itself. This memory corruption can trigger a Use-After-Free (UAF) vulnerability, causing the imagent process to crash. However, sophisticated attackers could potentially leverage this corruption as a primitive for achieving code execution on targeted devices. Organizations must rethink their use of third-party apps for sensitive communications. The NSA, in its guidance, has advised government personnel to avoid using Signal for classified or sensitive conversations. While that may not be practical for every business, it’s a strong signal (no pun intended) that not all encrypted apps are created equal.
There’s almost no precedent for the heads of defense, state, intelligence and national security to be sharing such sensitive military intelligence in a forum that was known to be unsecured. The 2023 Defense Department memo prohibited use of mobile applications for even “controlled unclassified information,” which is many degrees less important than information about ongoing military operations. Initially, Trump tried to downplay the incident, claiming that no classified or national security-relevant information was shared, and his team accused the magazine of having a political agenda. The main lesson from this episode is that we should treat our phone number like a password, not a trivial piece of information .
The platform has faced similar challenges before, including the notorious XcodeGhost malware in 2015 that infected WeChat version 6.2.5 alongside 38 other popular iOS applications, affecting hundreds of millions of users. PostMessage-tracker is a Chrome extension specifically designed to monitor and log all postMessage communications. It captures both sent and received messages, displays their origins, and allows you to inspect the message content in detail. This tool is particularly useful for understanding the complete postMessage flow in applications with multiple iframes or windows. The NCSC and international partners have seen growing malicious activity from Russia-based actors using messaging apps to target high-risk individuals.
He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world. Discover why strong encryption matters in the digital age, and how Wire safeguards secure communication across industries amid global backdoor… Those working in government should follow government guidance on the use of non-corporate communications channels.
Russian hacking groups, as reported by the NSA, have used phishing pages and malicious QR codes disguised as legitimate Signal group invite links. These links trick users into adding attacker-controlled devices to their Signal accounts. Once added, the attacker gains real-time access to all future messages in that conversation.
Signal’s security flaw was patched in September 2019, and the rest of the messaging apps were fixed more recently in the second half of 2020. The Project Zero researcher also looked at other popular messaging apps such as Telegram and Viber, but she could not find these particular security flaws. She looked at Telegram in August 2020, and Viber was investigated in November last year. Back in November 2018, the very same researcher brought to daylight a similar loophole in WhatsApp – it was affecting not only Android users, but the security flaw was observed on Apple devices too.
The discovered security flaws would allow a call to connect to a receiving device without notifying the receiver in any way. Hackers then listened quietly and, in some cases, even turned the camera on without alerting the owner of the targeted device. Many less popular applications have not been researched, and it is currently unknown if this security fault could be observed there.
