Connect with us

Technology

How 3.5B WhatsApp numbers were scraped and exposed

Published

on

How 3.5B WhatsApp numbers were scraped and exposed

NEWYou can now listen to Fox News articles!

Most major platforms have dealt with large-scale data leaks tied to weak or unprotected APIs. You’ve seen this play out with Facebook, X and even Dell.

The pattern is always the same. A feature meant to make life easier becomes a gateway for bulk data collection.

WhatsApp is now part of that list after researchers managed to scrape 3.5 billion phone numbers by exploiting a simple gap in the app’s contact-discovery system.

Sign up for my FREE CyberGuy Report 
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.   

Advertisement

How the researchers scraped 3.5B WhatsApp numbers

WHATSAPP BANS 6.8M SCAM ACCOUNTS, LAUNCHES SAFETY TOOL

Researchers discovered that weak API limits made it possible to scrape billions of WhatsApp numbers. (Getty Images)

As reported by Bleeping Computer, the entire incident started with WhatsApp’s GetDeviceList API. This is the endpoint the app uses when you add a number to your contacts. It tells WhatsApp to check if that number has an account and what devices are linked to it. The problem was that the API had no meaningful rate limiting. In simple terms, the system didn’t slow down or block repeated requests, which opened the door for mass enumeration.

Researchers from the University of Vienna and SBA Research decided to test how far they could push this. Using only five authenticated sessions and a single university server, they started hammering WhatsApp’s servers with queries. They expected to get blocked fast, but WhatsApp didn’t react at all.

That’s how they were able to check more than 100 million phone numbers per hour. After generating a global pool of 63 billion possible mobile numbers, they ran the list through the API and confirmed 3.5 billion active WhatsApp accounts.

Advertisement

Researchers managed to scrape more than just phone numbers

The researchers didn’t stop at confirming account existence. They used other WhatsApp endpoints like GetUserInfo, GetPrekeys and FetchPicture to pull more details. This included profile photos, “about” text, device information and public keys. A test run in the United States alone downloaded 77 million profile photos without hitting any limits, many with clear images of people’s faces. Public “about” sections often revealed personal info or links to other profiles. When compared to Facebook’s 2021 scrape, they found that 58% of leaked Facebook numbers were still active on WhatsApp years later. That’s what makes phone-number leaks so damaging. They stay useful to attackers long after the initial breach.

RUSSIAN LAWMAKERS CLAIM WHATSAPP IS A NATIONAL SECURITY THREAT, SHOULD PREPARE TO LEAVE THE COUNTRY

It’s important to note that this study was done by researchers who haven’t released the data. They also reported the issue to WhatsApp. The company has since added rate-limiting protections to prevent similar abuse from happening again. Still, the findings show how easily threat actors could have done the same thing if they had found the loophole first.

Why this keeps happening across major platforms

Weak or nonexistent API rate limits have caused several major data leaks in recent years, and WhatsApp isn’t the only example. In 2021, attackers abused Facebook’s “Add Friend” feature by uploading contact lists and checking which numbers matched active accounts. The API lacked proper safeguards, so they scraped 533 million profiles. Meta later confirmed the incident as automated scraping, and the Irish DPC fined the company €265 million.

Twitter had a similar problem when attackers used an API bug to match phone numbers and email addresses to 54 million accounts. Dell also reported that 49 million customer records were scraped after attackers took advantage of an unprotected API endpoint.

Advertisement

All of these cases share the same root cause. APIs that allow account lookups or data queries end up being easy to attack when they don’t limit how often someone can access them. One unchecked feature can turn into a pipeline for mass data collection.

7 steps you can take to keep your WhatsApp data safe

If your phone number ends up in one of these massive scrapes, you can’t pull it back, but you can make sure it’s far less useful to anyone trying to target you. Here are a few steps that help you stay safer.

1) Use two-factor authentication

Turn on 2FA for WhatsApp and every other important account. Even if someone has your number, they can’t break in without that second verification step. It also protects you from SIM-swap attempts since thieves can’t access your accounts with just a password.

A simple automated script pulled phone data at a massive scale without triggering alerts. (eyecrave productions/Getty Images)

2) Use a password manager

A password manager keeps every login unique. If attackers try to pair your scraped number with credential-stuffing attacks, reused passwords won’t give them an easy win. Strong, random passwords shut down a whole category of automated attacks.

Advertisement

Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

3) Remove your data from public databases

Opt out of data brokers and people-search sites when you can. The less public information attackers can tie to your number, the harder it is for them to craft convincing phishing messages or identity-based scams.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

IS YOUR FRIEND’S PHONE NUMBER COMPROMISED? HERE’S WHAT TO LOOK FOR

Advertisement

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

4) Limit what you share in profile bios

Keep your WhatsApp “about” text minimal. Avoid details like job titles, hometowns, or links to other accounts. Scraped phone numbers often get paired with publicly visible bios to build fuller profiles for scams.

5) Tighten your privacy settings

Adjust who can see your profile photo, last-seen and status. Setting these to “Contacts only” or “Nobody” prevents strangers from pulling more personal info once they have your number. To tighten your privacy settings on WhatsApp on iPhone or Android, follow these steps:

  • Open WhatsApp on your phone on your phone.
  • Go to Settings: On iPhone, tap the “Settings” gear icon at the bottom right. On Android, tap the three vertical dots in the top-right corner, then select “Settings.”
  • Tap “Account.”
  • Tap “Privacy.”
  • Adjust the privacy options below to control who can see your personal info:
  • Last Seen & Online: Tap “Last Seen & Online” and choose “My Contacts” or “Nobody” to restrict who sees your last active status.
  • Profile Photo: Tap “Profile Photo” and select “My Contacts” or “Nobody” to prevent strangers from viewing your profile picture.
  • About: Tap “About” and pick “My Contacts” or “Nobody” to limit who can see your About info.
  • Status: Tap “Status,” then select “My Contacts,” “My Contacts Except…,” or “Only Share With…” to control who can view your status updates.

These changes prevent people not in your contacts or strangers from pulling personal details from your WhatsApp profile, enhancing your privacy effectively on either iPhone or Android devices.

Because the system lacked proper rate-limiting, the scraping continued undetected for months. (Kurt Knutsson)

Advertisement

6) Install strong antivirus software

A lot of phishing and malware campaigns start with scraped numbers. Strong antivirus software can block malicious links, detect harmful downloads and warn you when something looks suspicious.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

7) Be cautious with unknown calls and messages

Treat unexpected messages with more suspicion. Don’t click links, don’t share OTPs, and don’t respond to anyone asking for verification codes. Once numbers are scraped, scammers ramp up spam and impersonation attempts.

Kurt’s key takeaway

WhatsApp might have fixed the issue, but the bigger problem is still out there. Any platform that exposes an API without proper rate limits is leaving a window open for someone with the right tools and enough time. This scrape shows you how quickly that window can turn into a firehose of personal data. Until API security becomes a priority across the board, you’ll keep seeing leaks like this repeat on bigger and bigger scales.

Advertisement

Do you think apps should be legally required to enforce strict API limits? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report 
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

Copyright 2025 CyberGuy.com.  All rights reserved.

Advertisement
Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Technology

Anthropic wants you to use Claude to ‘Cowork’ in latest AI agent push

Published

on

Anthropic wants you to use Claude to ‘Cowork’ in latest AI agent push

Anthropic wants to expand Claude’s AI agent capabilities and take advantage of the growing hype around Claude Code — and it’s doing it with a brand-new feature released Monday, dubbed “Claude Cowork.”

“Cowork can take on many of the same tasks that Claude Code can handle, but in a more approachable form for non-coding tasks,” Anthropic wrote in a blog post. The company is releasing it as a “research preview” so the team can learn more about how people use it and continue building accordingly. So far, Cowork is only available via Claude’s macOS app, and only for subscribers of Anthropic’s power-user tier, Claude Max, which costs $100 to $200 per month depending on usage.

Here’s how Claude Cowork works: A user gives Claude access to a folder on their computer, allowing the chatbot to read, edit, or create files. (Examples Anthropic gave included the ability fo “re-organize your downloads by sorting and renaming each file, create a new spreadsheet with a list of expenses from a pile of screenshots, or produce a first draft of a report from your scattered notes.”) Claude will provide regular updates on what it’s working on, and users can also use existing connectors to link it to external info (like Asana, Notion, PayPal, and other supported partners) or link it to Claude in Chrome for browser-related tasks.

“You don’t need to keep manually providing context or converting Claude’s outputs into the right format,” Anthropic wrote. “Nor do you have to wait for Claude to finish before offering further ideas or feedback: you can queue up tasks and let Claude work through them in parallel. It feels much less like a back-and-forth and much more like leaving messages for a coworker.”

The new feature is part of Anthropic’s (and its competitors’) bid to provide the most actually useful AI agents, both for consumers and enterprise. AI agents have come a long way from their humble beginnings as mostly-theoretically-useful tools, but there’s still much more development needed before you’ll see your non-tech-industry friends using them to complete everyday tasks.

Advertisement

Anthropic’s “Skills for Claude,” announced in October, was a partial precursor to Cowork. Starting in October, Claude could improve at personalized tasks and jobs, by way of “folders that include instructions, scripts, and resources that Claude can load when needed to make it smarter at specific work tasks — from working with Excel [to] following your organization’s brand guidelines,” per a release at the time. People could also build their own Skills for Claude relative to their specific jobs and tasks they needed to be completed.

As part of the announcement, Anthropic warned about the potential dangers of using Cowork and other AI agent tools, namely the fact that if instructions aren’t clear, Claude does have the ability to delete local files and take other “potentially destructive actions” — and that with prompt injection attacks, there are a range of potential safety concerns. Prompt injection attacks often involve bad actors hiding malicious text in a website that the model is referencing, which instructs the model to bypass its safeguards and do something harmful, such as hand over personal data. “Agent safety — that is, the task of securing Claude’s real-world actions — is still an active area of development in the industry,” Anthropic wrote.

Claude Max subscribers try out the new feature by clicking on “Cowork” in the sidebar of the macOS app. Other users can join the waitlist.

Continue Reading

Technology

Robots that feel pain react faster than humans

Published

on

Robots that feel pain react faster than humans

NEWYou can now listen to Fox News articles!

Touch something hot, and your hand snaps back before you even think. That split second matters.

Sensory nerves in your skin send a rapid signal to your spinal cord, which triggers your muscles right away. Your brain catches up later. Most robots cannot do this. When a humanoid robot touches something harmful, sensor data usually travels to a central processor, waits for analysis and then sends instructions back to the motors. Even tiny delays can lead to broken parts or dangerous interactions. 

As robots move into homes, hospitals and workplaces, that lag becomes a real problem.

A robotic skin designed to mimic the human nervous system

Scientists at the Chinese Academy of Sciences and collaborating universities are tackling this challenge with a neuromorphic robotic e-skin, also known as NRE-skin. Instead of acting like a simple pressure pad, this skin works more like a human nervous system. Traditional robot skins can tell when they are touched. They cannot tell whether that touch is harmful. The new e-skin can do both. That difference changes everything.

Advertisement

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

CES 2026 SHOWSTOPPERS: 10 GADGETS YOU HAVE TO SEE

A humanoid robot equipped with neuromorphic e-skin reacts instantly to harmful touch, mimicking the human nervous system to prevent damage and improve safety. (Eduardo Parra/Europa Press via Getty Images)

How the neuromorphic e-skin works

The e-skin is built in four layers that mirror how human skin and nerves function. The top layer acts as a protective outer covering, similar to the epidermis. Beneath it sit sensors and circuits that behave like sensory nerves. Even when nothing touches the robot, the skin sends a small electrical pulse to the robot every 75 to 150 seconds. This signal acts like a status check that says everything is fine. When the skin is damaged, that pulse stops. The robot immediately knows where it was injured and alerts its owner. Touch creates another signal. Normal contact sends neural-like spikes to the robot’s central processor for interpretation. However, extreme pressure triggers something different.

How robots detect pain and trigger instant reflexes

If force exceeds a preset threshold, the skin generates a high-voltage spike that goes straight to the motors. This bypasses the central processor entirely. The result is a reflex. The robot can pull its arm away instantly, much like a human does after touching a hot surface. The pain signal only appears when the contact is truly dangerous, which helps prevent overreaction. This local reflex system reduces damage, improves safety and makes interactions feel more natural.

Advertisement

ROBOTS LEARN 1,000 TASKS IN ONE DAY FROM A SINGLE DEMO

Scientists developed a robotic skin that can detect pain and trigger reflexes without waiting for a central processor to respond. (Han Suyuan/China News Service/VCG via Getty Images)

Self-repairing robotic skin makes fixes fast

The design includes another clever feature. The e-skin is made from magnetic patches that fit together like building blocks. If part of the skin gets damaged, an owner can remove the affected patch and snap in a new one within seconds. There is no need to replace the entire surface. That modular approach saves time, lowers costs and keeps robots in service longer.

Why pain-sensing skin matters for real-world robots

Future service robots will need to work close to people. They will assist patients, help older adults and operate safely in crowded spaces. A sense of touch that includes pain and injury detection makes robots more aware and more trustworthy. It also reduces the risk of accidents caused by delayed reactions or sensor overload. The research team says their neural-inspired design improves robotic touch, safety and intuitive human-robot interaction. It is a key step toward robots that behave less like machines and more like responsive partners.

What this technology means for the future of robots

The next challenge is sensitivity. The researchers want the skin to recognize multiple touches at the same time without confusion. If successful, robots could handle complex physical tasks while staying alert to danger across their entire surface. That brings humanoid robots one step closer to acting on instinct.

Advertisement

ROBOT STUNS CROWD AFTER SHOCKING ONSTAGE REVEAL

A new e-skin design allows robots to pull away from dangerous contact in milliseconds, reducing the risk of injury or mechanical failure. (CFOTO/Future Publishing via Getty Images)

Take my quiz: How safe is your online security?

Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my Quiz here: Cyberguy.com.

Kurt’s key takeaways

Robots that can feel pain may sound unsettling at first. In reality, it is about protection, speed and safety. By copying how the human nervous system works, scientists are giving robots faster reflexes and better judgment in the physical world. As robots become part of daily life, those instincts could make all the difference.

Advertisement

Would you feel more comfortable around a robot if it could sense pain and react instantly, or does that idea raise new concerns for you? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2026 CyberGuy.com. All rights reserved.

Advertisement
Continue Reading

Technology

You need to listen to Billy Woods’ horrorcore masterpiece for the A24 crowd

Published

on

You need to listen to Billy Woods’ horrorcore masterpiece for the A24 crowd

Billy Woods has one of the highest batting averages in the game. Between his solo records like Hiding Places and Maps, and his collaborative albums with Elucid as Armand Hammer, the man has multiple stone-cold classics under his belt. And, while no one would ever claim that Woods’ albums were light-hearted fare (these are not party records), Golliwog represents his darkest to date.

This is not your typical horrorcore record. Others, like Geto Boys, Gravediggaz, and Insane Clown Posse, reach for slasher aesthetics and shock tactics. But what Billy Woods has crafted is more A24 than Blumhouse.

Sure, the first track is called “Jumpscare,” and it opens with the sound of a film reel spinning up, followed by a creepy music box and the line: “Ragdoll playing dead. Rabid dog in the yard, car won’t start, it’s bees in your head.” It’s setting you up for the typical horror flick gimmickry. But by the end, it’s psychological torture. A cacophony of voices forms a bed for unidentifiable screeching noises, and Woods drops what feels like a mission statement:

“The English language is violence, I hotwired it. I got a hold of the master’s tools and got dialed in.”

Throughout the record, Woods turns to his producers to craft not cheap scares, but tension, to make the listener feel uneasy. “Waterproof Mascara” turns a woman’s sobs into a rhythmic motif. On “Pitchforks & Halos” Kenny Segal conjures the aural equivalent of a POV shot of a serial killer. And “All These Worlds are Yours” produced by DJ Haram has more in common with the early industrial of Throbbing Gristle than it does even some of the other tracks on the record, like “Golgotha” which pairs boombap drums with New Orleans funeral horns.

That dense, at times scattered production is paired with lines that juxtapose the real-world horrors of oppression and colonialism, with scenes that feel taken straight from Bring Her Back: “Trapped a housefly in an upside-down pint glass and waited for it to die.” And later, Woods seamlessly transitions from boasting to warning people about turning their backs on the genocide in Gaza on “Corinthians”:

Advertisement

If you never came back from the dead you can’t tell me shit
Twelve billion USD hovering over the Gaza Strip
You don’t wanna know what it cost to live
What it cost to hide behind eyelids
When your back turnt, secret cannibals lick they lips

The record features some of Woods’ deftest lyricism, balancing confrontation with philosophy, horror with emotion. Billy Woods’ Golliwog is available on Bandcamp and on most major streaming services, including Apple Music, Qobuz, Deezer, YouTube Music, and Spotify.

Continue Reading

Trending