Meta recently patched a high-severity vulnerability in WhatsApp for Windows (CVE-2025-30401) that allowed attackers to execute malicious code on a target’s machine by sending spoofed file types. The exploit didn’t require the user to do anything beyond opening what looked like a harmless file. This makes it particularly dangerous for less tech-savvy users and internal teams not trained in threat detection. What is known: \- Affected all WhatsApp for Windows versions prior to 2.2450.6 \- Exploited using specially crafted files with manipulated extensions \- Meta confirmed active exploitation before the patch was issued It’s a reminder that even popular desktop apps can become threat vectors when spoofing and user trust intersect. Were you or someone you know affected by this? Or have you seen this exploited in the wild in an org you work with?