Facebook subsidiary patches ‘very scary vulnerability’ that infected phones via missed WhatsApp calls alone.

Spyware crafted by an “advanced cyber actor” infected multiple targeted mobile phones through the popular WhatsApp communications program without any user intervention through in-app voice calls, the company said.

The Financial Times identified the actor as Israel’s NSO Group, and a WhatsApp spokesman later said “we’re certainly not refuting any of the coverage you’ve seen.”

The malware was able to penetrate phones through missed calls alone via the app’s voice calling function, the spokesman for the Facebook subsidiary said late Monday. An unknown number of people — an amount in the dozens at least would not be inaccurate — were infected with the malware, which the company said it discovered in early May, said the spokesman, who was not authorized to be quoted by name.

John Scott-Railton, a researcher with the internet watchdog Citizen Lab, called the hack “a very scary vulnerability.”

“There’s nothing a user could have done here, short of not having the app,” he said.

The WhatsApp spokesman said the attack had “all the hallmarks of a private company that has been known to work with governments to deliver spyware that has the ability to take over mobile phone operating systems.”

The spokesman said WhatsApp, which has more than 1.5 billion users, immediately contacted Citizen Lab and human rights groups, quickly fixed the issue and pushed out a patch. He said WhatsApp also provided information to US law enforcement officials to assist in their investigation.