WhatsApp Linked Devices Feature Abused in “Vote for My Friend” Account Takeover Scam

Attackers are hijacking WhatsApp accounts through a social-engineering scam that asks targets to “vote for my friend” or a relative in an online contest, then abuses WhatsApp’s legitimate Linked devices feature to gain persistent access. By convincing victims to approve an attacker-controlled linked session, the campaign lets criminals read chats, send messages as the victim, and spread the same lure to trusted contacts, increasing the scam’s reach through compromised accounts.

WhatsApp’s help documentation shows that linked devices are intended to let users access their account from additional devices, but the same workflow can be misused if a victim authorizes a session they did not initiate. Defenders and users are being urged to treat unsolicited voting links as suspicious, avoid linking any device unless they started the process themselves, regularly review and remove unknown entries from Linked devices, and enable two-step verification to reduce the risk of account takeover.