WhatsApp Linked Devices Scam Hijacks Accounts Through Fake Contest Voting

A WhatsApp scam is spreading through compromised accounts by asking targets to “vote for my friend” in online contests such as ballet performances, dog competitions, and school events. Victims receive the message from trusted contacts whose accounts have already been hijacked, then are redirected to pages that imitate WhatsApp or abuse the legitimate wa.me domain to trick them into linking an attacker-controlled device to their account instead of entering credentials.

By abusing WhatsApp’s Linked Devices feature, the attackers gain persistent, real-time access to messages and conversations without triggering password-reset warnings or failed-login alerts. The access lets them continue sending scam messages from the victim’s account and, in some cases, solicit money from friends and family; the main visible sign of compromise may be an unfamiliar device listed in the account’s linked devices settings. Researchers said the technique resembles GhostPairing, but uses contest-voting social engineering to drive account takeover.