Possible security issue: messages sent from my account that I cannot see, reported as spam by recipients

[lilrau]

While using Elecwhat (Electron-based WhatsApp Web client), my account appears to have sent multiple messages to various contacts without my knowledge or interaction.

However, there is a critical detail:

• I cannot see the messages myself
• In my chat history, they appear as "waiting for message" / not loaded
• Meanwhile, recipients responded mentioning deposits, betting, casino content

This suggests that messages were successfully delivered to others, but are not visible or properly synced on my side.

The behavior lasted for ~20 minutes and then stopped. After that, the session was disconnected automatically (likely by WhatsApp).

Important observations

• No other linked devices in WhatsApp settings
• No recent QR code scans
• No suspicious processes running (ps aux checked)
• No background Node.js scripts detected
• ~/.config/elecwhat permissions are restricted (no obvious leakage)

Environment

OS: Arch Linux
Installation method: AUR
Device: Personal desktop (single user)
Client: elecwhat-bin
Version: 1.13.4-1
Architecture: x86_64
Build Date: seg 02 mar 2026 00:33:22
Install Date: seg 02 mar 2026 00:33:47
Install Script: No

[EDIT] Sorry, forgot to say i use IOS on mobile, so the security issue can't be on the original WhatsApp device.

[piec]

Very weird!

[SubatomicPlanets]

@piec I think this should stay open until we know what happened. I will not be using ElecWhat until this is figured out.
It seems like it could be one of these:

• Some kind of session hijacking. In this case there might be some malware or infostealer on @lilrau's device...
• ElecWhat has malware in it. Seems unlikely.
• This report is false or is wrong in some way. Seems unlikely too.
• Some kind of bug?

@lilrau it would be nice if you could answer these questions so we can narrow it down:

• How many messages were sent? Did it seem like a spam bot or like a human manually typing these?
• Were messages with these contents sent by you or your contacts before? If so, maybe it was some duplication bug?
• For how long did you use your Arch device? How many AUR packages do you have? Is it possible that you might have installed some infostealer malware at some point?
• Did it send these messages to your contacts or to random phone numbers? And did it also send these in groups?
• How much time passed from logging into ElecWhat to the first messages being sent?
• Any other info would be helpful too.

Also, while I'm at it, @piec the readme says "Can be trusted: Automatically built by GitHub Actions (CI)" but I believe release assets can be modified after release. I may be wrong on this but I don't think the release binaries can be verified to belong to the source code right now. I found this in the GitHub documentation so you may want to look at it. Never used GitHub actions though so if I'm wrong please let me know.

[piec]

Hi,
I reopened it, but I don't know what to do with it. I felt the issue was unrelated to ElecWhat.
You are right about github releases, I can modify the assets afterwards. The CI job could show digests, and they could be verified to be correct in the assets.

[lilrau]

@SubatomicPlanets sure!

• Messages were sent to around 10 to 20 people, only 1 message per chat.
• The messages never loaded on my devices (just "Waiting for this message. This may take a while."). To be honest, I've already deleted the conversations as well. Few people replied, bots talking about tiktok scams and casino, or regular people upset about losing money.
• I've been using Arch for about a year, this installation for about 5 months. I have a lot of AUR packages, but malware seems unlikely since this machine is only for work and I basically just install IDEs, CLIs, and other development-related tools.
• Random phone numbers, but all Brazilian (same country code as mine). No groups.
• Around 1 month or so?

Unfortunately, I don't have any additional information. A few days after the report, my WhatsApp account got suspended, but after opening a ticket and explaining the situation, my account was restored. I ended up migrating to Chrome-based app and I'm currently using the official WhatsApp Web client. It's a very intriguing situation...

[SubatomicPlanets]

Thanks for the extra info!
I did some more searching and the most likely possibility is some kind of WhatsApp web session hijacking. It doesn't seem to be related to ElecWhat or Linux because I found these Reddit posts with the same issue:

• HELP. Someone appears to be sending messages.
• what is going on with whatsapp
• I didnt send this messages. What’s happening?
• Someone cloned my WhatsApp account sending spam messages from my account
• Update on my 24 hr under review account!

These posts are also from within the last month and all the numbers start with +55 too. And there are even more people having the same issues in the comments on those posts. I have no idea how this would happen though... It seems unlikely that all those people have some malware installed. Maybe WhatsApp had some bug which the attackers used?
Anyway, Since you also said it took around a month after ElecWhat login for this to happen, I think it's safe to assume this has nothing to do with ElecWhat.

If this makes sense to you both then I think we can close this issue.
@piec I think the link I sent about "artifact attestations" is the recommended way to do this, but for me the digest printing would definitely be good enough!

[piec]

Thanks for the investigation, probably a vulnerability in WhatsApp that is now solved, might be related to WhatsApp web.

I'll update the ci jobs in order to display the digests.