Loading story…
A WhatsApp scam is spreading through compromised accounts by asking targets to “vote for my friend” in online contests such as ballet performances, dog competitions, and school events. Victims receive the message from trusted contacts whose accounts have already been hijacked, then are redirected to pages that imitate WhatsApp or abuse the legitimate wa.me domain to trick them into linking an attacker-controlled device to their account instead of entering credentials.
By abusing WhatsApp’s Linked Devices feature, the attackers gain persistent, real-time access to messages and conversations without triggering password-reset warnings or failed-login alerts. The access lets them continue sending scam messages from the victim’s account and, in some cases, solicit money from friends and family; the main visible sign of compromise may be an unfamiliar device listed in the account’s linked devices settings. Researchers said the technique resembles GhostPairing, but uses contest-voting social engineering to drive account takeover.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Malwarebytes reported a WhatsApp scam campaign in which messages from already-compromised contacts asked targets to vote for a friend or acquaintance in an online contest. The campaign tricked victims into linking an attacker-controlled device to their WhatsApp account, enabling message access and further scam propagation.
Researchers documented abuse of WhatsApp's linked devices mechanism under the name GhostPairing. The technique used fake photo-viewer pages rather than the later contest-voting lure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are hijacking WhatsApp accounts through a social-engineering scam that asks targets to “vote for my friend” or a relative in an online contest, then abuses WhatsApp’s legitimate **Linked devices** feature to gain persistent access. By convincing victims to approve an attacker-controlled linked session, the campaign lets criminals read chats, send messages as the victim, and spread the same lure to trusted contacts, increasing the scam’s reach through compromised accounts. WhatsApp’s help documentation shows that linked devices are intended to let users access their account from additional devices, but the same workflow can be misused if a victim authorizes a session they did not initiate. Defenders and users are being urged to treat unsolicited voting links as suspicious, avoid linking any device unless they started the process themselves, regularly review and remove unknown entries from **Linked devices**, and enable **two-step verification** to reduce the risk of account takeover.
Aug 4, 2026
A social-engineering technique dubbed **GhostPairing** is being used to hijack WhatsApp accounts by abusing the app’s legitimate **Linked Devices** feature rather than stealing passwords or one-time codes. Attackers reportedly trick victims into approving an attacker-controlled companion device through deceptive QR codes, fake support interactions, messages, or other pretexts, giving criminals persistent access to chats while the victim may remain unaware. Once a rogue device is linked, attackers can read messages, monitor conversations, impersonate the victim, and use the trusted account for payment fraud, phishing, identity abuse, invoice scams, and executive impersonation targeting business partners. Researchers said the tactic reflects a broader criminal shift toward abusing trusted digital workflows, and recommended that users review WhatsApp linked sessions, remove unknown devices, enable **two-step verification**, secure phones with screen locks, and independently verify urgent or unusual requests.
Jul 16, 2026
A new WhatsApp account takeover campaign, dubbed the **GhostPairing attack**, leverages social engineering to trick users into granting attackers access to their accounts without requiring password theft or SIM swapping. Victims receive a message from a trusted contact, typically stating "Hey, I just found your photo!" and containing a link that appears to be a Facebook preview. When the link is clicked, users are directed to a convincing fake Facebook page that prompts them to "verify" their identity. This process covertly guides the victim through WhatsApp's device-linking flow, resulting in the attacker's device being added as a linked device on the victim's account. The attack exploits WhatsApp's legitimate device pairing feature, making the compromise appear as a user-approved action. The campaign was first observed in Czechia, with messages sent from compromised accounts to local contacts, and the infrastructure relies on a network of lookalike domains designed to mimic Facebook. Security researchers emphasize that there is no password theft or SIM swap involved; instead, the attack relies entirely on user manipulation. Users are advised to be cautious of unexpected messages, even from known contacts, and to scrutinize any requests to verify or link devices within WhatsApp.
Jun 29, 2026