- Messaging apps accumulate technical vulnerabilities, excessive metadata, and human errors that can lead to massive leaks and scandals.
- WhatsApp, Signal, and other consumer solutions do not offer the controls or compliance needed for critical, healthcare, legal, or government sectors.
- Organizations must migrate to enterprise messaging platforms with robust encryption, key control, auditing, and data sovereignty.
- The combination of appropriate tools, updates, training, and individual best practices drastically reduces risk in digital communication.
Messaging apps have become central to our digital lives : we coordinate work, make plans with friends, send sensitive documents, and even share medical and financial details. This massive use, however, has revealed an uncomfortable truth: the more we rely on these tools, the more attractive they become to cybercriminals, and the more serious any design flaw or human error becomes.
In recent years, serious vulnerabilities have been exposed in WhatsApp , Signal, Telegram, and other platforms , along with high-profile incidents involving governments, businesses, and healthcare organizations, demonstrating that a "simple chat" can lead to multimillion-dollar fines, massive data leaks, or genuine political scandals. Throughout this article, we will calmly but frankly examine why these tools are not harmless, what real risks they pose, and what alternatives and best practices exist to minimize the potential for disaster.
Massive vulnerabilities in WhatsApp and the fragility of phone numbers
One of the most striking recent cases was discovered by a team of researchers from the University of Vienna and SBA Research , who found a large-scale weakness in WhatsApp's contact detection mechanism. This feature, designed to check which numbers in your address book use the app, became an ideal entry point for the mass scraping of accounts.
Thanks to this weakness, researchers demonstrated that it was possible to query more than 100 million phone numbers per hour through WhatsApp's infrastructure, ultimately enumerating some 3.500 billion active accounts in 245 countries. The system responded to an enormous number of requests from a single source, when the reasonable course of action would have been to reject or limit them. This behavior was precisely what exposed the flaw.
From each validated number, an attacker could extract public data associated with the WhatsApp profile : public keys, timestamps, status message, profile picture, and, by cross-referencing this information, even the operating system, account age, and number of linked devices. Although Meta claimed to have patched the vulnerability and that it had no impact on users, it is extremely difficult to prove that no one silently exploited it before the research was published.
As security expert Luis Corrons pointed out, a careful attacker would perform the scan slowly and across many IP addresses , blending in with normal traffic and evading detection. The discovery also revealed that around half of the numbers leaked in the massive Facebook scraping of 2021 were still active on WhatsApp, demonstrating that phone numbers, in practice, function as a near-permanent identifier.
The main lesson from this episode is that we should treat our phone number like a password, not a trivial piece of information . Configuring WhatsApp so that only contacts see your profile picture and information text, avoiding posting your primary phone number on public websites, and using a specific number for ads or business inquiries are small steps that significantly reduce your exposure.
Privacy and metadata: the dark side of “free” chat rooms
Beyond specific vulnerabilities, messaging apps suffer from a structural problem: they collect a massive amount of personal data and metadata . Even when content is end-to-end encrypted, information about who is talking to whom, when, from where, and on what device can be pure gold for attackers and anyone looking to perform mass profiling.
In the case of WhatsApp, phone numbers of all contacts, device data, usage patterns, group memberships , profile pictures, status messages, IP addresses, location data, and even payment information (where available) are systematically collected. This data can be used to reconstruct social and professional networks, internal relationship maps within a company, travel habits, and even organizational hierarchies.
Many organizations, driven by urgency or cost savings, have sought refuge in consumer apps like WhatsApp, Telegram, or Signal to coordinate sensitive tasks in critical, governmental, or business sectors. However, what at first glance sounds like a cheap and familiar solution often hides hidden costs: loss of control over data, regulatory non-compliance , confidentiality breaches, and, in the worst cases, breaches with devastating reputational impact.
Another sensitive issue is cloud backups . Although messages are encrypted during transmission, many applications encourage backups to third-party services, which don't always maintain the same level of encryption and can become the weak link. A poorly secured cloud backup can completely negate the benefit of end-to-end encryption.
Desktop cybersecurity risks: Electron, keys, and malware
When we move from the mobile version to the desktop versions, things get even more complicated. The vast majority of desktop messaging clients are built on Electron, a framework that encapsulates a web application within a Chromium browser . This is very convenient for developers because it allows them to create a "native" app for multiple operating systems simultaneously, but it also means inheriting Chromium's inherent vulnerabilities.
Chrome and Chromium are, quite literally, prime targets for cybercriminals . Their vulnerabilities are quickly researched and exploited, and Google typically responds with frequent patches. The problem is that Electron-based programs don't always update their embedded engine at the same pace, so a vulnerability already fixed in the browser can remain active for months in a desktop messaging client.
Added to this is a very serious risk: the encryption keys for the conversations are stored on the computer's hard drive . If someone manages to compromise the device with malware, it is much easier to steal these keys on a desktop computer than on a mobile device, where the system architecture and security mechanisms make remote access to this type of information much more difficult.
Finally, it's important not to forget the role of messaging apps as a distribution channel for malicious files . While email attachments and web downloads are usually met with some level of suspicion, many users download files received via chat without a second thought, especially if sent by a supposed colleague on a tool marketed as "secure." This overconfidence is precisely what attackers are looking for.
High-level human errors: from the wrong group to political scandal
Beyond the technical issues, there's one factor that software can't patch: human error in app usage . We've all sent a message to the wrong group at some point, from an inappropriate comment to a heart emoji misdirected at the boss. It usually remains an embarrassing anecdote, but when messaging and sensitive matters are mixed up, the mess can escalate to historic proportions.
A prime example was the Signal chat among high-ranking officials in the Trump administration , in which military operations against the Houthis in Yemen were coordinated. National Security Advisor Mike Waltz mistakenly added Jeffrey Goldberg, editor of The Atlantic magazine, to a group called “Houthi Small Contact Group,” granting him access to information about the exact timing of attacks and the weaponry to be used.
The conversation included names like Vice President JD Vance, Secretary of Defense Pete Hegseth, Director of National Intelligence Tulsi Gabbard, Secretary of State Marco Rubio, and CIA Director John Ratcliffe, among others. The famous phrase "I joined the wrong chat" went from a joke to a global example of the recklessness of discussing military secrets in an encrypted chat without formal controls.
Initially, Trump tried to downplay the incident, claiming that no classified or national security-relevant information was shared, and his team accused the magazine of having a political agenda. However, under pressure, The Atlantic decided to publish the group's full contents so that the public could assess the seriousness of the matter, also revealing disparaging remarks about European allies that had already surfaced at other summits.
The incident drew comparisons to Hillary Clinton's use of private email and reignited the debate about the suitability of instant messaging tools for handling top-secret information , no matter how encrypted they are. The moral of the story is clear: encryption protects against external espionage, but it doesn't correct careless decisions or recipient errors.
Phishing, impersonation, and WhatsApp account hijacking
Another area where messaging apps have become a hunting ground for criminals is identity theft and phishing . Campaigns that were previously limited to email are now also distributed via SMS, WhatsApp, and other channels, with messages that pretend to be legitimate notifications to trick users into clicking where they shouldn't.
A typical example is an email that appears to be from WhatsApp and invites you to "back up your messages and call history" via a link. Clicking on it, instead of a backup, downloads malicious software that can steal data, take control of the account, or even persistently infect the device.
In recent months, there has also been an increase in attempts to hijack WhatsApp accounts using social engineering. Leveraging personal data collected from previous breaches or social media, the attacker impersonates an acquaintance, technical support, or a trusted entity, convincing the victim to provide the verification code received via SMS.
That code, which many apps (including banking, social media, and SMS-ID authentication systems) use as a second layer of security , is the master key. Sharing it, even "because a friend asked for it," is tantamount to handing over control of the account on a silver platter. Once inside, the criminal can impersonate the victim to request money, access previous conversations, or extend the attack to other services linked to the same number.
Faced with these types of threats, the solution involves strengthening awareness and basic security hygiene : being wary of unexpected messages that ask for codes or passwords, activating additional verification systems (such as WhatsApp's two-step verification PIN), and periodically checking which devices are logged into our account.
Risks in healthcare and corporate environments: why "any WhatsApp" won't do
In organizations like the Balearic Islands Health Service , instant messaging has become an essential tool for rapid communication between professionals, but that doesn't mean you can use just any app you have on your personal phone. The choice of tool directly impacts patient data confidentiality and legal compliance.
For this reason, Microsoft Teams has been chosen as the corporate messaging application in this environment , making it clear that instant communication among healthcare staff must be conducted exclusively through this platform. Teams is integrated into the Office 365 ecosystem, which offers specific security solutions to mitigate ransomware, identity theft, data breaches, and threats associated with malicious URLs and files.
At the same time, the importance of keeping all applications updated and using strong passwords is emphasized to reduce the window of exposure to known vulnerabilities. User training is key: understanding that every delay in updating or every weak password opens opportunities for potential attackers.
In the healthcare sector, and in any other organization subject to strict regulations such as HIPAA, GDPR, SOX or defense requirements, messaging apps designed for the general public often lack essential business controls : centralized user administration, retention policies, full access traceability, data leakage prevention or integration with identity management systems.
Real-life examples abound: from hospitals fined millions for allowing the use of WhatsApp to coordinate patients, to law firms where the use of Signal with clients raised questions about attorney-client privilege and led to malpractice lawsuits. These situations make it clear that, however tempting it may be to take advantage of a popular app, the price to pay can be enormous.
Salt Typhoon, critical infrastructure, and the limits of consumer messaging
Attacks attributed to groups like Salt Typhoon against major telecommunications providers have highlighted the fragility of the communications infrastructure that underpins governments, businesses, and critical services. Faced with this sense of vulnerability, many organizations have turned, almost instinctively, to consumer messaging apps as a quick fix to "secure" internal communications.
The problem is that these tools, while offering better protection than SMS or unencrypted email , are not designed for the level of security required for high-value strategic communications. They tend to concentrate the infrastructure in a few of the provider's data centers, creating single points of failure and prime targets for attackers and legal pressure from foreign governments.
From a regulatory standpoint, many of these platforms don't align well with specific requirements in sensitive sectors , such as archiving and auditing obligations in finance, legal withholdings in litigation, or data sovereignty restrictions in government contracts. Using them to process information subject to these regulations is a gamble that, sooner or later, an inspection or incident will reveal the non-compliance.
In the realm of data sovereignty, the use of global services also means that information can end up stored in jurisdictions with very different access laws , or even laws that contradict local regulations. This opens the door both to intelligence gathering by third-party states and to complex legal battles over which legislation applies to each piece of information.
Therefore, organizations that manage critical infrastructure or highly sensitive information need solutions designed from the ground up for their reality: zero-knowledge architecture, encryption key under customer control , on-premises or hybrid deployments that guarantee data sovereignty, and a complete set of advanced audit, retention, integration, and authentication features.
Cellcrypt and enterprise platforms: a different approach to security
Faced with the limitations of general-purpose apps, platforms specifically designed for secure business and government communications , such as Cellcrypt, have been gaining ground. These solutions are based on a clear premise: the provider must not be able to read the content or accumulate more metadata than is strictly necessary.
Cellcrypt adopts a zero-knowledge architecture with end-to-end encryption and client-side key control . This is complemented by double-layer post-quantum encryption, based on NIST-standardized algorithms, designed to withstand both current attacks and future "capture now, decrypt later" scenarios when quantum computing becomes a realistic threat.
In environments where state secrets or defense information are handled, these types of solutions have approvals from organizations like NATO and government certifications , as well as external audits that validate their design and implementation. It's not just a matter of technology, but of demonstrating, with documentation and evidence, that the most demanding standards are met.
From the administration side, platforms of this style offer centralized user management, role-based access control, remote provisioning and removal of devices , enforcement of security policies, and auditing and reporting tools that allow documentation of who accessed what, when, and from where—something essential in regulated sectors.
In terms of deployment, the options are highly flexible: from on-premises installations for complete data control, to cloud-based or hybrid models that balance rapid adoption, scalability, and sovereignty . Functionally, features include encrypted voice and video calls, messaging and group chats, protected file and screen sharing, and additional measures such as capture blocking, remote wiping, and geofencing to restrict access to specific locations.
For this transition to be viable, a phased strategy is typically implemented: an audit of current messaging usage, policy definition, controlled pilot programs, gradual rollout, and effective implementation that includes an explicit ban on consumer apps for sensitive communications. Without this regulatory and educational component, technology alone is insufficient.
Best practices for users and resources for further learning
On an individual level, there are several guidelines anyone can follow to reduce their exposure when using messaging apps. The first is to treat phone numbers and codes received via SMS as sensitive credentials that should never be shared , even if the person requesting them appears to be a friend, a technician, or the app itself.
It's a good idea to review the privacy settings of each app to limit who can see your profile picture, description, last seen time, or public profile. The less information that's publicly available, the harder it will be for an attacker to create a convincing scam or link your number to other leaked data.
On the technical side, it's essential to keep your devices protected with up-to-date antivirus software and operating systems , and to be wary of any unexpected links or files, even if they come from a known contact (their account may also have been compromised). Thinking twice before clicking can save you a lot of trouble.
There are many useful resources available from organizations like INCIBE: infographics for creating strong passwords, blog posts about common user mistakes , guides for identifying phishing attempts, and specialized newsletters on email, password managers, and how to properly report online fraud. These clear materials, designed for the general public, help integrate cybersecurity into everyday life.
At an organizational level, combining a suitable corporate tool (Teams, encrypted enterprise solutions like Cellcrypt, etc.) with regular training in best practices and monitoring of unauthorized remote access tools and cloud services significantly reduces the scope for attackers and internal negligence. It's not about living in fear, but about being aware that, with a few reasonable measures, most disasters can be avoided.
Everything we've seen demonstrates that messaging apps are as powerful as they are delicate: they make life easier, but any technical or human error can have very serious consequences in terms of privacy, compliance, and security. Evaluating which tool we use for each type of conversation, minimizing the exposure of our data, and opting for enterprise solutions when the information demands it is the best way to continue enjoying the immediacy of chat without turning it into our digital Achilles' heel.
