I have a more clear event: At my company we regularly communicate single use credit card numbers for company purchases. One of those was sent via WhatsApp, and stolen. Neither the origin phone nor the destination phone were compromised. The card was used to purchase Adwords, the transaction originated in the US (we are in Europe).

Our theory is that at least images on WhatsApp are human-reviewed, and one reviewer saw the credit card go through and took the opportunity.

We reversed the transaction and switched to Signal...