Loading story…
WhatsApp is preparing to introduce unique usernames that would let people message each other without sharing phone numbers, a change positioned as a privacy improvement for group chats, events, and first-time contacts. The feature is designed without a public directory, requiring users to know an exact username, but officials and cybersecurity authorities have warned it could also make impersonation and phishing easier by allowing attackers to register lookalike names resembling trusted individuals, brands, banks, or government bodies.
India’s Ministry of Electronics and Information Technology (MeitY) has asked WhatsApp to suspend the rollout until it receives government approval, arguing the feature could fuel phishing, so-called digital arrest scams, and fraud targeting public authorities and financial institutions in WhatsApp’s largest market of more than 850 million users. WhatsApp said it plans safeguards including contextual warnings, reserved usernames for legitimate organizations, lookalike protections, contact-initiation limits, anti-enumeration controls, and abuse-detection systems, while security guidance has urged users to verify suspicious contacts through official channels and advised organizations to reserve official usernames early and clearly communicate their legitimate accounts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Finland’s Traficom warned that WhatsApp’s planned introduction of unique usernames could increase impersonation and phishing attempts, as attackers may register lookalike names resembling trusted people, brands, or organizations. It advised users to verify suspicious contacts through official channels and urged organizations to reserve official usernames early.
India’s Ministry of Electronics and Information Technology sent WhatsApp a letter demanding that it suspend deployment of planned usernames until it receives government approval, citing risks of phishing, impersonation, and scam abuse. The ministry gave WhatsApp three days to respond.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WhatsApp has begun rolling out global username reservations for a new privacy feature that lets people connect without exposing their phone numbers. The change, aimed at the platform’s more than three billion users, will allow new contacts and businesses to start conversations using a unique username instead of a phone number, with broader availability expected later in 2026. WhatsApp said the feature is designed for scenarios such as meeting strangers, joining group chats, and making professional connections, while creators, small businesses, and organizations may be able to claim matching Instagram or Facebook names. The company said discovery will be tightly limited: there will be no public directory, no browsable listings, and no username suggestion algorithm, so a person must know the exact username to initiate first contact. WhatsApp is also introducing an optional **username key**, a secondary credential that requires someone to know both the username and the key before they can message a user for the first time, adding another layer of protection against unwanted outreach and reducing exposure of users’ phone numbers.
Jul 3, 2026
The Indian government has introduced new regulations requiring messaging apps such as WhatsApp, Telegram, Signal, and Snapchat to operate only with active SIM cards linked to users’ phone numbers. This move is intended to curb the rising incidents of cyber fraud and misuse, particularly those perpetrated from outside the country using Indian mobile numbers. Under the new rules, web and desktop sessions must automatically log out within six hours, and users will be required to re-verify their accounts frequently. Messaging app providers have 90 days to implement these changes and 120 days to report compliance, as part of an amendment to the 2024 Telecom Cyber Security Rules. The Department of Telecommunications (DoT) stated that the previous ability to maintain long-lived sessions without an active SIM was being exploited for large-scale, cross-border scams, phishing, and other fraudulent activities. By enforcing SIM-binding and frequent re-verification, authorities aim to close this security loophole and make it more difficult for criminals to operate anonymously or from abroad using Indian identifiers. The new measures are a direct response to the increasing sophistication of cybercriminals targeting Indian users through messaging platforms.
Jul 12, 2026
A rapidly expanding WhatsApp account hijacking campaign, dubbed HackOnChat by CTM360, is targeting users worldwide through a network of deceptive authentication portals and impersonation pages. Attackers exploit WhatsApp's web interface and use social engineering tactics, such as fake security alerts and spoofed group-invite messages, to trick users into compromising their accounts. The campaign leverages thousands of malicious URLs hosted on inexpensive domains, with a surge in activity noted across the Middle East and Asia. Once an account is compromised, attackers use it to target the victim's contacts for further scams, data theft, and extortion, often propagating the attack chain through phishing messages sent from the hijacked account. Research from UC San Diego highlights the broader social engineering strategies employed by scammers, including the use of long, trust-building conversations that often transition to WhatsApp as the preferred platform for executing fraud. The study found that scammers typically delay financial requests until after extensive interaction, using personal conversation and subtle verification techniques to build credibility. These findings underscore the effectiveness of WhatsApp as a tool for scammers and the sophistication of their methods in orchestrating account takeovers and subsequent fraudulent activities.
Jun 29, 2026