WhatsApp Launches ‘Strict Account Settings’ to Block Malicious Attachments

WhatsApp has unveiled a new “Strict Account Settings” feature alongside a massive structural overhaul of its code, as it seeks to protect journalists and public figures from increasingly sophisticated cyber-attacks.

The messaging giant, which provides end-to-end encryption for over three billion people, stated that while its default privacy protections remain robust, certain users require “extreme safeguards” against rare, state-level spyware.

Consequently, the firm is rolling out a “lockdown-style” mode that limits how the app functions to prevent digital infiltration.

The new feature, found under Settings > Privacy > Advanced, allows users to lock their account to the most restrictive possible configuration.

Once enabled, the app will automatically block all attachments and media sent from people not saved in the user’s contacts.

By implementing these barriers, WhatsApp aims to close off common entry points used by hackers who hide malicious code within seemingly innocent files.

Although the rollout is gradual, the company expects the feature to be available to all users in the coming weeks.

Beyond user-facing settings, WhatsApp noted it has completed what it describes as the “largest rollout globally” of the Rust programming language.

“In a significant technical shift, engineers have replaced 160,000 lines of C++ code with 90,000 lines of Rust. The decision to migrate was driven by a need for “memory safety.” Traditional languages like C++ are often prone to bugs that allow hackers to gain control of a device through a process called a memory exploit.By contrast, Rust is designed to prevent these errors entirely,”wrote Daniel Sommermann and  Baojun Wang, Engineers at WhtsApp in the official blog.

The firm said the move to harden media defenses follows the “Stagefright” vulnerability of 2015, which left millions of Android devices exposed to malware hidden in MP4 video files. Because that bug lived within the phone’s operating system, app developers were initially powerless to fix it.

To prevent a repeat of such an event, WhatsApp said it has developed a system called “Kaleidoscope.”

WhatsApp’s “Kaleidoscope” security system operates as a sophisticated defensive layer designed to intercept malicious files before they can reach a user’s device.

This ensemble of checks works by detecting “masquerading” files, which effectively identifies when a dangerous executable is disguised as a harmless image, and by meticulously scrutinizing PDFs for embedded scripts or hidden files that could act as a vehicle for spyware.

Furthermore, the system performs a rigorous format validation to ensure that every shared video or photo strictly adheres to global standards.

By validating the structure of these files before they are processed by the phone’s underlying operating system libraries, WhatsApp can prevent “parser differential” exploits that traditionally target unpatched vulnerabilities in a device’s software.

While the transition to Rust presented hurdles, specifically an initial increase in “binary size” and the need for a complex new build system, WhatsApp confirmed the language is now “production ready at a global scale.”

The library is currently distributed every month to billions of devices, including smartphones, desktops, and wearables.

Moving forward, the company said it intends to accelerate the adoption of memory-safe languages, moving away from C++ for new code to ensure that private conversations remain just as secure online as they are in person.