Join Maximilian Günther and Gabriel Gegenhuber at DEF CON 34 in Baltimore on August 7, 2026, where they will present their talk, “Gotta Catch ‘Em All: How To Capture 3.5 Billion WhatsApp Accounts.”
Abstract
Contact discovery on instant messengers is designed to help users find their friends. But when identifiers are predictable and safeguards are weak, it allows attackers to find everyone. At that point, “catching ’em all” stops being a slogan and becomes an engineering problem.
In this talk, we show how we turned WhatsApp into a global Pokédex. By combining reverse-engineered API access with large-scale phone number generation, we probed tens of billions of candidates and identified over 3.5 billion active WhatsApp accounts — all from a single machine, without raising flags and getting blocked.
Beyond simple presence checks, enumeration exposes rich metadata, including profile pictures, public keys, device information, timestamps, and user-defined about tags. This enables both macroscopic insights into global platform usage and profiling of individual users.
Our analysis uncovers systemic issues, such as persistent exposure of numbers from historical data leaks and reuse of cryptographic keys across accounts. Moreover, we expose signals of criminal activity (e.g., drug dealers and scam factories), and measurable activity in regions where WhatsApp is officially restricted (e.g., North Korea).
At global scale, small design decisions become big problems. This is what allowed us to complete our 3.5B-sized Pokédex.
https://github.com/sbaresearch/whatsapp-census
Paper: Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy, Gegenhuber et al., NDSS 2026
Speaker
Maximilian Günther
Gabriel Gegenhuber
Further information
About the Conference
DEF CON is the world’s largest hacker conference, bringing together thousands of security researchers, industry experts, government representatives, and technology enthusiasts every year in Las Vegas. Renowned for its highly technical talks, hands-on workshops, Capture-the-Flag competitions, and community-driven villages, DEF CON serves as a global platform for sharing the latest cybersecurity research, fostering collaboration, and exploring emerging threats and defensive technologies.