WhatsApp Begins Limited Beta Testing of On-Device Scam Alert to Detect Fraud While Preserving End-to-End Encryption
WhatsApp, owned by Meta, has launched limited beta testing of its Scam Alert feature designed to warn users about potentially fraudulent messages from strangers.
The protection relies on a machine learning model that runs directly on the smartphone. Conversation content is never transmitted to WhatsApp or Meta, preserving end-to-end encryption. After activation, the device downloads the model and examines dialogue structure along with linguistic signs of fraud.
When a message appears suspicious, the recipient sees a warning while the sender remains unaware. Users can then block the contact, file a report, dismiss the alert, or designate the chat as trusted. In the trusted case, the last five messages can optionally be shared to help improve the model.
To prevent Meta from deploying a customized analyzer to specific users, every model release is recorded in an immutable log. A manifest containing SHA-256 hashes is signed with Ed25519 keys controlled by Cloudflare. The smartphone verifies the signature, log entry, and file integrity before executing the model.
WhatsApp collects only anonymized counters of detections and subsequent user actions. The app also includes a Scam Alert Activity log showing check results and model versions.
The current release remains an early technical preview. Meanwhile, Signal has introduced automatic key verification that uses a cryptographically verifiable log and allows users to confirm no unauthorized intermediary is present. Independent audits are performed by Cloudflare and Trail of Bits without access to user data.
Related articles
Silent Call Answering on Android: Defeating Phone Spam by Removing Human Attention
A detailed proposal suggests abandoning traditional spam call blocking in favor of allowing all incoming calls to connect automatically while keeping them invisible to the user. The approach uses Android's Telecom Framework and InCallService to answer calls silently without ringing, notifications, or screen activation. This breaks the economic model of mass dialing systems by inflating answered call metrics with empty connections that contain no human. The concept separates the technical establishment of a call from delivering user attention, forcing spammers to detect real people after the connection is made. Implementation requires the app to hold the ROLE_DIALER role and selectively invoke Call.answer() based on custom rules instead of always showing the incoming call UI. The author argues this shifts the detection burden onto robocall platforms and reduces the value of every successful connection.
Telegram Scam Bot Exposed by Fixed Timer and Deleted Messages in Telethon Userbot Analysis
A detailed investigation into a romance scam attempt on Telegram revealed an AI-driven userbot masquerading as a woman named Maria from Yaroslavl. The bot maintained consistent 4-5 minute response delays regardless of message length or time of day, responded to deleted messages, and accumulated multiple inputs before replying in batches. It refused out-of-character requests using repetitive phrases like "I am not a..." and handed off media or confusing inputs to a human operator. The bot failed to react to a nonexistent city name and ignored voice messages containing silence, leading to delayed human intervention. The chat was later deleted from the scammer side after testing, and the account ignored messages from a second profile. The analysis includes a full reconstruction of the bot's logic using the Telethon library, highlighting prompt protections against jailbreaks and reliance on fixed delays.
CACTER Upgrades PhishSim Anti-Phishing Simulation System to Reduce Employee Click Rates
CACTER has released an updated version of its PhishSim anti-phishing training platform that allows organizations to run realistic simulated attacks in just four steps. The system replicates common phishing vectors including malicious links, infected attachments, and disguised QR codes while spoofing sender addresses and official domains. Organizations can draw from a continuously refreshed template library covering invoices, financial subsidies, system notifications, and industry-specific scenarios. After each campaign the platform produces detailed visual reports that rank departments, classify employee risk levels, and recommend concrete remediation steps. Long-term use of the platform has been shown to lower average click rates from 23.88 percent to 4.16 percent. The solution is designed for immediate deployment without requiring dedicated security staff.
Scammers Abuse Custom GPT on ChatGPT.com to Deploy Windows RAT via ClickFix Technique
Researchers at Huntress uncovered a phishing campaign that leveraged a custom GPT named Plus 5.6 hosted directly on the official ChatGPT.com domain. Victims searching for ChatGPT were directed to the malicious GPT through sponsored Google results, where the bot instructed them to visit a backup domain due to alleged service issues. The link led to a Google Sites page mimicking a Cloudflare security check that triggered the ClickFix social engineering tactic. Users were prompted to copy and execute a command in Windows, initiating a multi-stage infection with a remote access trojan capable of full system control, file access, screen viewing, and camera or microphone activation. Huntress confirmed at least 40 incidents tied to the campaign, though only two infections were directly traced to the malicious GPT. The first GPT was removed on September 25 after notification, but a replacement linked to the same operation appeared by September 27.