HackInBo® Classic Edition Winter 2026 #HiB26

Saluti ai partecipanti e agli Sponsor

Fine prevista per le 10:45

Since May 2026, cases of WhatsApp compromise have been reported both in Italy and in several other countries. Every report shared the same characteristics: an up-to-date WhatsApp application, an outdated iOS version, fraudulent messages requesting money sent to the victim's contacts without ever appearing in the chat on the phone, and a list of linked devices showing no anomalies. Starting from the first report, we began collecting diagnostic logs (sysdiagnose) and full filesystem forensic images in order to investigate the compromise through forensic analysis and answer two questions: what method was used to compromise the devices, and how was WhatsApp manipulated to carry out the fraud? After several weeks of research, we have reached a number of concrete results: based on the analysis of the collected evidence, the WhatsApp compromise appears to be linked to Coruna, a sophisticated malware discovered a few months earlier by researchers at the Google Threat Intelligence Group and iVerify. The outdated iOS versions found on all affected devices are consistent with the exploitation of N-day vulnerabilities rather than zero-days. In this talk we will cover three aspects: the attack chain that led to the compromise of the iOS devices; the inner workings of the WhatsApp module used by Coruna, including the techniques and methodologies the malware employed to hijack the victim's WhatsApp session in order to send fraudulent messages to their contacts; and, finally, a potentially new technique used to clone WhatsApp sessions.

Fine prevista per le 12:15

Ci rivediamo tra pochissimo...

Fine prevista per le 14:15