High effort is not a great thing to count on. Once these things are discovered there are all sorts of clever (or not so clever) ways to automate the effort away. Especially now with AI.

This is not high effort. Starting from an open source WhatsApp client library, reproducing the attacks described in the research paper is trivial. There are even a few public github repos implementing PoCs of this.

Whether the reward should be considered high or low is ultimately subjective. What is objectively verifiable, however, is that an attacker can continuously (and silently) monitor several aspects of a target’s environment, including:

• the number of devices linked to the target’s account, along with fingerprints that allow differentiation between operating systems and browsers
• the locked or unlocked state of the target’s phone
• whether the phone is connected via Wi-Fi or a mobile network
• whether the WhatsApp application or browser tab is running in the foreground or background.

In addition, an attacker could deliberately drain the target’s phone battery and consume their mobile data allowance.