Anyone with WhatsApp installed on their phone might want to review their settings after new security advice has been issued. The massively popular messaging app recently came under scrutiny after a worrying flaw was discovered that could allow hackers to access personal data by sending malicious files directly to users’ phones. The issue, first identified by Google’s Project Zero team, is linked to WhatsApp’s automatic media download feature, which instantly saves files to devices without any user interaction.

Crafty Cybercriminals are thought to have exploited this function by creating fake WhatsApp group chats and inviting unsuspecting users to join. If an invitation was accepted, infected files could be downloaded automatically, without the user realising anything was wrong.

While it’s unclear exactly how many people may have been impacted by the issue, the discovery of the attack is concerning, given the billions of people who use WhatsApp every day.

WhatsApp has confirmed it has now released a fix to prevent future attacks, but the incident has once again highlighted the risks of allowing automatic downloads on mobile devices. For added peace of mind, users are advised to ensure they are running the latest version of the app and to make a few simple changes to their settings.

Security experts at Malwarebytes are now recommending disabling automatic media downloads or enabling WhatsApp’s Advanced Privacy Mode. This prevents photos, videos, and documents from being saved to your phone automatically.

Here’s the latest advice from Malwarebytes and how to switch off automatic downloads.

“Google’s Project Zero has just disclosed a WhatsApp vulnerability where a malicious media file, sent into a newly created group chat, can be automatically downloaded and used as an attack vector,” Malwarebytes explained.

“The bug affects WhatsApp on Android and involves zero‑click media downloads in group chats. You can be attacked simply by being added to a group and having a malicious file sent to you.

“According to Project Zero, the attack is most likely to be used in targeted campaigns, since the attacker needs to know or guess at least one contact. While focused, it is relatively easy to repeat once an attacker has a likely target list.”

To turn off automatic downloads on Android, open WhatsApp and tap the three-dot menu in the top-right corner, then select Settings. From there, go to Storage and data. Under Media auto-download, you’ll see options for When using mobile data, When connected on Wi-Fi, and When roaming.

Tap each option in turn and uncheck all media types—Photos, Audio, Videos, and Documents—then tap OK. Once complete, each category should display “No media.”

Malwarebytes also advises restricting who can add you to WhatsApp groups, as this type of attack relies on attackers adding victims to new group chats.

To do this, open Settings, tap Privacy, then Groups. Change the setting from Everyone to My contacts, or preferably My contacts except…, and exclude any numbers you don’t fully trust.

If you use WhatsApp for work, it’s especially important to limit group access to known contacts and approved administrators only.

As mentioned before, one of the best things you can do is keep your apps updated and make sure the latest version is installed.