German police can access any WhatsApp message without any malware

https://www.heise.de/news/BKA-nutzt-WhatsApp-Webfunktion-zum... (German) says they had physical access to the device and likely simply logged in to WhatsApp web in a browser. There's an always active notification indicating your account is used on the web but apparently that's easily circumvented by disabling a notification category, leaving the suspect to specifically go somewhere in the app to notice.

The websites keep talking about a "method" that the Germany police agency used to track chats on Whatsapp in real-time but is too much work to implement for every suspect. The agency did not comment on it.

Why do I have a feeling that they just used the unlocked mobile device of the user, logged into the user's WhatsApp web mirror and disabled the "Whatsapp web is active" notification allowing them to track the activity in real-time? Given that the user was already a suspect becuase of close links to a prvious terrorist.

I’m tired to read this. In the original news it is stated that they basically scan the QR code to access the messages via WhatsApp web. It’s not like it’s some kind of magical backdrop. You can see and manage the web access in your WhatsApp application in your phone and delete access.