Israeli NSO Group Suspected of “MMS Fingerprint” Attack on WhatsApp

Enea reports that NSO Group likely used a novel "MMS Fingerprint" technique—sending binary MMS/WSP Push notifications that trigger automatic MM1_retrieve HTTP GETs—to leak device UserAgent and x-wap-profile fields without user interaction; this information can enable tailored exploits and has been linked to Pegasus spyware targeting journalists, activists, and officials. The technique was demonstrated against sample SIMs and captured via packet traces; mitigations include disabling MMS auto-retrieval where possible and filtering/blocking binary MMS notifications to attacker-controlled URLs.