Security

What's Campaign is designed so the campaign database and device-control agent remain on the user's Windows computer.

Local-only agent service

The agent listens on 127.0.0.1:8765, which is the local computer's loopback interface rather than a public network address. API requests require the private local agent token.

Windows agent distribution

The Windows companion agent is published only after an explicit release step. A production build is kept in the local release folder first, where its SHA-256 checksum can be verified and the executable can be scanned before publication.

The website download is enabled only when that reviewed build and checksum are intentionally copied into web/downloads. This avoids automatically exposing a freshly built executable.

Verify a download

Download the SHA-256 checksum file beside the Windows Agent ZIP and compare the ZIP hash with the value produced by Windows PowerShell Get-FileHash -Algorithm SHA256. The checksum file also lists the expected SHA-256 of the extracted WhatsCampaignAgent.exe. A mismatch means the download should not be run.

Windows code signing is recommended for commercial distribution. Until a release is signed by a trusted certificate, Windows SmartScreen may warn that the publisher is unknown. Do not bypass warnings unless you have independently verified the file.

USB debugging

The agent requires the user to explicitly authorize USB debugging on their own Android device. Users should revoke debugging authorization when they no longer want the computer to control the device.

Report concerns

If a downloaded file, page, or behavior appears different from what is described here, stop using it and verify that you are on the official site before continuing.