Hackers Can Leverage Delivery Receipts on WhatsApp and Signal to Extract User Private Information

Security researchers disclosed a privacy vulnerability called “Careless Whisper” that lets attackers abuse silent delivery receipts and RTT timing in WhatsApp and Signal to infer device state, app usage, and user activity (including battery and network changes) without alerts or prior contact; the issue affects billions of users, enables high-frequency probing (causing data/battery drain), and remains without a full patch, with researchers recommending contact-restricted receipts, RTT noise, message ID validation, and server rate limits.