Loading story…
Attackers are hijacking WhatsApp accounts through a social-engineering scam that asks targets to “vote for my friend” or a relative in an online contest, then abuses WhatsApp’s legitimate Linked devices feature to gain persistent access. By convincing victims to approve an attacker-controlled linked session, the campaign lets criminals read chats, send messages as the victim, and spread the same lure to trusted contacts, increasing the scam’s reach through compromised accounts.
WhatsApp’s help documentation shows that linked devices are intended to let users access their account from additional devices, but the same workflow can be misused if a victim authorizes a session they did not initiate. Defenders and users are being urged to treat unsolicited voting links as suspicious, avoid linking any device unless they started the process themselves, regularly review and remove unknown entries from Linked devices, and enable two-step verification to reduce the risk of account takeover.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
WhatsApp published help documentation describing how its Linked devices feature works, including linking additional devices to a WhatsApp account. This feature is later cited as the mechanism abused by the scam.
A scam campaign is reported as actively spreading through WhatsApp messages that ask recipients to vote for a friend or relative in an online contest. The messages often come from already-compromised contacts and aim to trick victims into authorizing an attacker-controlled linked device session.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A WhatsApp scam is spreading through compromised accounts by asking targets to “vote for my friend” in online contests such as ballet performances, dog competitions, and school events. Victims receive the message from trusted contacts whose accounts have already been hijacked, then are redirected to pages that imitate WhatsApp or abuse the legitimate `wa.me` domain to trick them into linking an attacker-controlled device to their account instead of entering credentials. By abusing WhatsApp’s **Linked Devices** feature, the attackers gain persistent, real-time access to messages and conversations without triggering password-reset warnings or failed-login alerts. The access lets them continue sending scam messages from the victim’s account and, in some cases, solicit money from friends and family; the main visible sign of compromise may be an unfamiliar device listed in the account’s linked devices settings. Researchers said the technique resembles **GhostPairing**, but uses contest-voting social engineering to drive account takeover.
Aug 11, 2026
A social-engineering technique dubbed **GhostPairing** is being used to hijack WhatsApp accounts by abusing the app’s legitimate **Linked Devices** feature rather than stealing passwords or one-time codes. Attackers reportedly trick victims into approving an attacker-controlled companion device through deceptive QR codes, fake support interactions, messages, or other pretexts, giving criminals persistent access to chats while the victim may remain unaware. Once a rogue device is linked, attackers can read messages, monitor conversations, impersonate the victim, and use the trusted account for payment fraud, phishing, identity abuse, invoice scams, and executive impersonation targeting business partners. Researchers said the tactic reflects a broader criminal shift toward abusing trusted digital workflows, and recommended that users review WhatsApp linked sessions, remove unknown devices, enable **two-step verification**, secure phones with screen locks, and independently verify urgent or unusual requests.
Jul 16, 2026
A new WhatsApp account takeover campaign, dubbed the **GhostPairing attack**, leverages social engineering to trick users into granting attackers access to their accounts without requiring password theft or SIM swapping. Victims receive a message from a trusted contact, typically stating "Hey, I just found your photo!" and containing a link that appears to be a Facebook preview. When the link is clicked, users are directed to a convincing fake Facebook page that prompts them to "verify" their identity. This process covertly guides the victim through WhatsApp's device-linking flow, resulting in the attacker's device being added as a linked device on the victim's account. The attack exploits WhatsApp's legitimate device pairing feature, making the compromise appear as a user-approved action. The campaign was first observed in Czechia, with messages sent from compromised accounts to local contacts, and the infrastructure relies on a network of lookalike domains designed to mimic Facebook. Security researchers emphasize that there is no password theft or SIM swap involved; instead, the attack relies entirely on user manipulation. Users are advised to be cautious of unexpected messages, even from known contacts, and to scrutinize any requests to verify or link devices within WhatsApp.
Jun 29, 2026