Global WhatsApp Account Hijacking Campaign via Social Engineering

A rapidly expanding WhatsApp account hijacking campaign, dubbed HackOnChat by CTM360, is targeting users worldwide through a network of deceptive authentication portals and impersonation pages. Attackers exploit WhatsApp's web interface and use social engineering tactics, such as fake security alerts and spoofed group-invite messages, to trick users into compromising their accounts. The campaign leverages thousands of malicious URLs hosted on inexpensive domains, with a surge in activity noted across the Middle East and Asia. Once an account is compromised, attackers use it to target the victim's contacts for further scams, data theft, and extortion, often propagating the attack chain through phishing messages sent from the hijacked account.

Research from UC San Diego highlights the broader social engineering strategies employed by scammers, including the use of long, trust-building conversations that often transition to WhatsApp as the preferred platform for executing fraud. The study found that scammers typically delay financial requests until after extensive interaction, using personal conversation and subtle verification techniques to build credibility. These findings underscore the effectiveness of WhatsApp as a tool for scammers and the sophistication of their methods in orchestrating account takeovers and subsequent fraudulent activities.