WhatsApp groups: change these two settings to protect your Android smartphone

Suddenly added to a new WhatsApp group – and your phone could become an entry point for attackers without you clicking anything.

Millions of people use WhatsApp groups to manage everyday life. What many people do not realise is that an inconspicuous default setting in the app may enable criminals to place malicious code on Android smartphones. Security researchers are now issuing a stark warning and advise changing two key settings.

Why WhatsApp groups can create a security risk

WhatsApp groups are convenient: family, friends, colleagues, nursery, sports club – almost everyone belongs to several chats at once. Photos, documents, voice notes and links are shared there, often within seconds.

However, this very group feature can also leave the messenger exposed. People are often placed in chats they never knowingly agreed to join. A casual acquaintance, an old contact or anyone with your number can simply add you. All of a sudden, complete strangers can see your telephone number, profile photo and, often, your status.

This goes beyond a data-protection issue: it can result in spam, unwanted advertising, fraud attempts and targeted attacks. Researchers at Google Project Zero and security company Malwarebytes have now demonstrated how groups can be exploited for a particularly sensitive form of attack.

Security researchers' finding: attacks without a click

The experts say that an attacker initially needs only the target's number saved in their address book. That number can be used to create a new group and add the victim, even where the two barely know one another.

In newly created groups of this kind, manipulated files can be sent which download automatically to Android devices – without any action from the user.

This particular sequence creates the danger:

• A new group is created
• The victim is added without being asked first
• A malicious image, video or document is posted in the chat
• The file is downloaded automatically to the smartphone's storage

This creates a possible route for an attack: the user may not even actively open WhatsApp, but the file is already on the device. Depending on a vulnerability in the system or app, such a download may serve as the starting point for further attacks.

What causes the automatic download

On many Android devices, WhatsApp downloads chat media automatically by default, including images, audio, videos and, in some cases, documents. While restricting this to Wi-Fi, for example, is intended to save mobile data, it also removes many choices from the user.

Automatic downloads are convenient – they shift control from “I decide myself” to “the app decides for me”.

This is less noticeable in ordinary chats, but the situation changes in groups containing many unknown participants. Nobody there knows who is behind each profile or what intentions lie behind a file sent unexpectedly.

The weakness highlighted by the researchers primarily affects WhatsApp on Android. The attack relies on group media being downloaded without permission and remaining in the background as a potential attack vector.

WhatsApp has responded – but users still need to take action

According to Malwarebytes, the messenger's operator has released a patch. Anyone who updates the app regularly will benefit from this fix as well as further safeguards.

Nevertheless, one issue remains: an update will not usually alter existing default preferences. Anyone who previously granted broad permissions will keep them. For this reason, security researchers recommend two specific changes in the settings.

Step 1: Who can add you to WhatsApp groups?

The first step is to control who can put you in groups in the first place. On Android and iOS, the relevant option is found in WhatsApp's privacy settings.

How to change the group settings

• Open WhatsApp
• Tap the three dots in the top right-hand corner (Android), or tap “Settings” in the bottom right-hand corner (iOS)
• Select Privacy
• Tap Groups
• Choose My Contacts rather than “Everyone”
• For more sensitive profiles, select My Contacts Except... and exclude risky contacts

Anyone who leaves “Everyone” enabled opens the door for strangers to enter their group history – and access their number and profile picture.

This should be set particularly strictly by people with public profiles, journalists, employees using work phones and people who share many numbers professionally. The fewer people who can start groups involving you, the lower the risk.

Step 2: Disable automatic media downloads

The second control concerns the automatic downloading of photos, videos and other files. It is worth briefly checking the data and storage settings.

How to stop automatic downloads on Android

• Tap the three dots in WhatsApp again
• Open Settings
• Go to Storage and Data
• Under Media Auto-Download, review the options for mobile data, Wi-Fi and roaming
• For all three, deselect every media type or permit only very limited file types

From then on, WhatsApp will ask whether a file should genuinely be downloaded when it arrives. The download starts only after you tap the image or document – an important additional step for your security.

No automatic download means: every file must be actively “approved” by you – which reduces the risk dramatically.

How serious is the threat in reality?

The described vulnerability specifically targets newly created groups in which media is downloaded without a prompt. Security professionals stress that people working with sensitive information are of particular interest, including employees in public authorities, businesses, healthcare and research sites.

Private users can also become targets, however, such as those who frequently share their number on second-hand online marketplaces, participate in a public club or are visible on social networks. The more widely your number circulates, the easier it is for attackers to obtain this piece of the puzzle.

Other risks associated with WhatsApp groups

Beyond automatic downloads, groups offer further attack opportunities that are often underestimated:

• Profile picture misuse: Strangers can save your image and use it for fake profiles or identity theft.
• Phishing messages: Criminals disguise links as supposed prize draws or urgent system alerts.
• Social engineering: Over time, attackers build trust in order to obtain personal details.
• Data sharing: Screenshots from group chats can quickly end up outside their original context.

Remaining sceptical about group invitations and viewing unknown participants critically significantly reduces these risks. A group chat full of unfamiliar profiles is not a private space, even if it feels like one.

Practical tips for using WhatsApp more safely

Alongside the two central settings, several straightforward everyday habits can help:

• Do not share sensitive documents, such as identity documents, contracts or health information, in larger groups
• Choose a profile photo that does not reveal too much about your home area, children or workplace
• Do not message unfamiliar numbers in groups straight away
• Check suspicious group links manually in a browser rather than tapping them directly
• Update WhatsApp and your operating system regularly

Many users underestimate how valuable their telephone number is. Combined with a name, profile photo and chat history, it can form a personal profile that fraudsters can exploit deliberately.

What “attack vector” actually means

The term sounds technical, but it describes something very straightforward: a file can be the first step in an entire chain of manipulation. A manipulated image might exploit a flaw in image processing; a malicious video could target a specific decoder; and a document may attempt to crash the app while executing external code.

Not every such file immediately causes a complete phone failure. In the worst case, though, an attacker may access data, read messages or download further malware. The fewer unknown files that arrive on a device without control, the smaller this risk becomes.

Why these two settings make such a difference

Many security recommendations remain vague or require complicated actions. The two changes described here take only a few minutes and combine several benefits at once:

• The number of unwanted groups is kept under control
• Strangers see your number and profile less often
• Potentially dangerous files no longer appear in storage without permission
• You decide yourself when a file is actually allowed onto your device

An extra layer of security is particularly worthwhile on Android devices, where users often install many apps and grant permissions generously. Anyone who uses WhatsApp every day should make time for these small adjustments – they provide considerably more protection than they may initially appear to.