I ve been playing with the Careless Whisper side-channel idea and hacked together a small PoC that shows how you can track a phone s device activity state (screen on/off, offline) via WhatsApp without any notifications or visible messages on the victim s side.
How it works (very roughly):
uses WhatsApp via an unofficial API
sends tiny probe reactions to special/invalid message IDs
WhatsApp still sends back silent delivery receipts
I just measure the round-trip time (RTT) of those receipts
Device Activity Tracker is an open-source proof-of-concept that shows how you can infer a phone’s activity state via WhatsApp & Signal — using only timing information from “ghost” reactions.
