Even opening WhatsApp photo can hack your phone; Kerala Police warns, explains how to stay protected

Kerala Police on Tuesday warned users that simply opening a photo received on WhatsApp could lead to their phone being hacked. In this new form of cyber fraud, scammers send what appears to be a normal image — but it may actually contain hidden malware capable of stealing banking details, passwords, OTPs, UPI information, and even taking control of the phone without the user’s knowledge.

The technique behind the scam involves steganography, a method in which hackers embed harmful data within images. When the recipient opens the image, the malware activates, handing over control of the device to cybercriminals. Unlike typical frauds, victims receive no OTP warning or alert.

Police advise caution to avoid falling prey

Authorities have urged the public not to download images or videos from unknown numbers and to avoid clicking suspicious links. Users are advised to disable media auto-download in WhatsApp settings. Keeping phone software and antivirus updated is also essential to reduce risk.

In case of any online financial fraud, victims are encouraged to report the matter immediately by dialling 1930.

Steganography explained

Cybercriminals are now using a stealthy technique called steganography to target WhatsApp users across various parts of India. Unlike traditional scams involving suspicious links or OTPs, this new method hides malware within image files, making it difficult for users to detect the threat.

Steganography involves concealing malicious code within ordinary-looking images. The most common form, known as Least Significant Bit (LSB) steganography, hides the malware in the smallest parts of an image file. When such an image is opened, the malware activates silently and begins compromising the user’s device.

Once triggered, the malware can steal sensitive information such as banking credentials, OTPs, passwords, and UPI data. It can also grant remote access to fraudsters, allowing them to control the phone, access apps, and withdraw money — all without the user's knowledge.

Reports of such scams are emerging from multiple regions in India, highlighting a growing trend of image-based attacks via WhatsApp. These scams often begin with a message from an unknown number, sometimes followed by calls to prompt the user into opening the infected image.