A potentially serious security flaw has been discovered in WhatsApp for Windows, but Meta believes it’s up to users to avoid getting infected.
Security researcher Saumyajeet Das recently analyzed the Windows version of WhatsApp and found that while most dangerous file types, such as .EXE, .COM, .SCR, and .BAT, are blocked from running directly, there are exceptions. Files with extensions .PYZ (Python ZIP app), .PYZW (PyInstaller program), and .EVTX (Windows event log) can be executed immediately if opened through WhatsApp.
The issue arises when a user clicks “Open” on one of these files, which can then execute any script or malicious code contained within. However, this risk is somewhat mitigated as the user must have Python installed for the attack to succeed, limiting potential targets to developers and tech-savvy users.
Das reported this vulnerability to Meta in early June 2024. In response, Meta acknowledged the issue but indicated it would not be addressing it directly. Instead, the company advises users to be cautious with unknown files, regardless of the platform they come from.
Meta’s statement emphasizes user vigilance: “We warn users to never click on or open a file from somebody they don’t know, regardless of how they received it — whether over WhatsApp or any other app.”
