ThreatsDay Bulletin: WhatsApp Hijacks, MCP Leaks, AI Recon, React2Shell Exploit and 15 More Stories

Emerging Threat Landscape: Adaptability and Reconnaissance

This week’s ThreatsDay Bulletin reveals a trend of attackers refining existing tools and exploiting familiar systems in novel ways. Small tactical shifts are accumulating rapidly, indicating potential future breach points.

The speed at which attackers are adapting is outpacing defensive measures, with vulnerabilities like React2Shell (CVE-2025-55182) being exploited by ransomware groups within minutes of initial access, impacting over 60 organizations and highlighting the cost of delayed patching and proactive security measures.

Key Insights

• WhatsApp Hijack via QR Code, 2025: A new “GhostPairing” attack uses QR codes to hijack WhatsApp accounts by exploiting the legitimate device linking feature.
• Exposed MCP Servers: Roughly 1,000 Model Context Protocol (MCP) servers were found exposed on the internet without authorization, potentially allowing access to sensitive data and systems.
• AI-Driven ICS Scanning: Threat actors are leveraging AI to automate reconnaissance and exploitation of Industrial Control Systems (ICS), potentially causing disruptions to critical infrastructure like solar panel output.

Working Example

# Example Python code to check for linked devices in WhatsApp (conceptual)
# This is not a complete implementation and requires WhatsApp API access.

def check_linked_devices():
    """
    Checks for linked devices in a WhatsApp account.
    (Requires authentication and API access - not shown here)
    """
    try:
        # Authenticate with WhatsApp API
        # ...

        # Get list of linked devices
        linked_devices = get_linked_devices_from_api()

        if linked_devices:
            print("Linked Devices:")
            for device in linked_devices:
                print(f"- {device['name']} ({device['platform']})")
        else:
            print("No devices are currently linked.")

    except Exception as e:
        print(f"Error checking linked devices: {e}")

# Call the function
check_linked_devices()

Practical Applications

• Critical Infrastructure: AI-driven scanning of ICS devices, as observed by Cato Networks, could lead to targeted attacks on essential services like power grids.
• Social Engineering: The WhatsApp GhostPairing attack demonstrates the effectiveness of social engineering tactics that exploit user trust and legitimate platform features.

References:

• https://thehackernews.com/2025/12/threatsday-bulletin-whatsapp-hijacks.html