Loading story…
A phishing campaign targeting high-profile individuals involved in Iran-related activities has been using WhatsApp messages to lure victims to a fake site that impersonates WhatsApp Web and steals access to accounts and other credentials. U.K.-based Iranian activist and investigator Nariman Gharib shared the phishing link and technical findings, which indicated the operation aimed to compromise WhatsApp accounts and harvest credentials (including Gmail and other online logins), with victims including a Middle Eastern academic in national security studies, the head of an Israeli drone maker, a senior Lebanese cabinet minister, at least one journalist, and individuals with U.S. phone numbers. TechCrunch reported it was able to view a real-time copy of victim submissions because the attackers’ server storing responses was left exposed without a password, showing dozens of victims had entered credentials and were likely subsequently compromised.
Technical reporting described the attack as a “surveillance kit” that hijacks accounts by abusing the WhatsApp Web linking flow: the phishing page continuously polls the attacker’s infrastructure and presents a live QR code tied to the attacker’s own WhatsApp Web session, so when a victim scans it they unknowingly authenticate the attacker’s browser and link their account. The infrastructure was reported as hosted on a DuckDNS domain and running on an Ubuntu server with nginx. Beyond account takeover, the kit was described as requesting browser permissions that could enable invasive monitoring—camera, microphone, and location access—allowing attackers to capture photos, record audio in intervals, and track location in near real time; attribution remained uncertain in one report, while another linked the activity to Iranian intelligence.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
By the time TechCrunch published its analysis, the phishing site was no longer accessible. The takedown followed public scrutiny and technical investigation of the campaign infrastructure.
Public reporting linked the operation to Iranian intelligence or IRGC-linked spearphishing based on observed patterns, while other researchers said the infrastructure could also fit financially motivated cybercrime. This marked a notable attribution debate as more technical details became public.
TechCrunch reported that the attackers’ server exposed victim-submission logs without authentication, allowing real-time viewing of entered credentials and other submitted data. The logs indicated dozens of impacted individuals across the Iranian diaspora and the Middle East, including high-profile targets.
WhatsApp responded by advising users not to click links from unknown senders and to report suspicious messages. The company’s statement came as coverage highlighted the campaign’s account-takeover and surveillance risks.
Analysis of the phishing kit showed it relayed a live WhatsApp Web QR code from the attacker’s browser session to the victim, allowing rapid account hijacking when scanned. The kit also sought browser permissions that could enable collection of location, photos, audio, camera, and microphone access.
After receiving the phishing link, Gharib posted redacted screenshots publicly and warned others not to click suspicious links. He also shared the full phishing URL and a write-up of his findings with TechCrunch and other researchers.
U.K.-based Iranian activist Nariman Gharib was targeted with a WhatsApp message containing a phishing link. He assessed the activity as aimed at people involved in Iran-related political, media, activist, or research work.
Lookalike phishing infrastructure used in the campaign included domains such as alex-fabow.online, which TechCrunch reported were registered in early November 2025. The related domains suggested preparation for broader targeting of Gmail and WhatsApp users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcetechcrunch.com
Open sourcetechrepublic.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A rapidly expanding WhatsApp account hijacking campaign, dubbed HackOnChat by CTM360, is targeting users worldwide through a network of deceptive authentication portals and impersonation pages. Attackers exploit WhatsApp's web interface and use social engineering tactics, such as fake security alerts and spoofed group-invite messages, to trick users into compromising their accounts. The campaign leverages thousands of malicious URLs hosted on inexpensive domains, with a surge in activity noted across the Middle East and Asia. Once an account is compromised, attackers use it to target the victim's contacts for further scams, data theft, and extortion, often propagating the attack chain through phishing messages sent from the hijacked account. Research from UC San Diego highlights the broader social engineering strategies employed by scammers, including the use of long, trust-building conversations that often transition to WhatsApp as the preferred platform for executing fraud. The study found that scammers typically delay financial requests until after extensive interaction, using personal conversation and subtle verification techniques to build credibility. These findings underscore the effectiveness of WhatsApp as a tool for scammers and the sophistication of their methods in orchestrating account takeovers and subsequent fraudulent activities.
Jun 29, 2026
The Dutch intelligence and military security services (**AIVD** and **MIVD**) warned of a **large-scale Russian cyber campaign** targeting individual **Signal** and **WhatsApp** accounts—particularly those of government officials, journalists, and military personnel—by persuading victims to disclose **security verification codes** and **PINs**. The activity does **not** involve breaking end-to-end encryption or exploiting a technical vulnerability in the apps; instead, it abuses legitimate account and security workflows. One commonly observed tactic is impersonation of a *Signal Support* chatbot to solicit verification information, enabling account takeover and access to messages and group chats. The agencies also reported abuse of the apps’ **“linked devices”** functionality, where attackers attempt to attach an additional device to a victim’s account to mirror messages in real time. AIVD/MIVD assessed that the campaign has already produced victims, including within the Dutch government, and that attackers likely accessed sensitive information as a result. Separate reporting about a fake *Red Alert* Android app used to spy on Israeli users describes a different mobile-malware operation (SMS lure, sideloaded trojanized app, extensive permissions, and data exfiltration) and is not part of the Signal/WhatsApp account-takeover campaign.
Jun 29, 2026
A campaign dubbed **Boss Scam** is targeting Indian enterprises by hijacking senior executives’ **WhatsApp Web** sessions and using the real accounts to send fraudulent payment requests. Attackers reportedly lure victims with urgent compliance-themed messages, including notices impersonating regulators such as the Reserve Bank of India, and deliver malicious ZIP archives that executives are tricked into forwarding to finance staff. Indian authorities said the scheme has led to rapid transfers to mule accounts, with some cases involving losses of up to **Rs. 2,45,00,000**. The ZIP files contain a legitimate signed executable paired with a malicious DLL that abuses **DLL sideloading** on Windows. Once executed, the malware can establish persistence, search Chromium-based browsers for active WhatsApp Web sessions, and steal cookies, authentication tokens, IndexedDB data, saved credentials, and encryption material; some reports say the data is archived with `tar.exe` and exfiltrated over TCP to clone the victim’s session. The attackers then impersonate executives or trusted employees to request wire transfers, spread additional malicious messages, or steal corporate information, and may fall back to saving an attacker-controlled number under the executive’s name if the hijacked session is cut off.
Jul 3, 2026