HackOnChat WhatsApp account-hijacking campaign
Campaign
Summary
Hide ▲
Show ▼
The HackOnChat operation is rapidly expanding a WhatsApp account-hijacking campaign that steals access through deceptive authentication portals and impersonation pages. It has generated thousands of malicious URLs and hundreds of incidents in recent weeks, showing broad operational scale. The activity is spreading across the Middle East and Asia and puts users at risk of account takeover, fraud, and downstream phishing from compromised accounts.
Related Happenings
AccountDumpling Google AppSheet Facebook phishing campaign
Campaign
First: 01.05.2026 21:09
Last: 01.05.2026 21:09
Sources 1
About this happening:
A **Vietnamese-linked** operation dubbed **AccountDumpling** is using **Google AppSheet** as a phishing relay to steal **Facebook** credentials, enabling account takeover at scale...
AccountDumpling Google AppSheet Facebook phishing campaign
CampaignAbout this happening: A **Vietnamese-linked** operation dubbed **AccountDumpling** is using **Google AppSheet** as a phishing relay to steal **Facebook** credentials, enabling account takeover at scale...
Augmented Marauder / Water Saci multi-pronged phishing campaign targeting Latin America and Europe
Campaign
First: 01.04.2026 15:36
Last: 01.04.2026 15:36
Sources 1
About this happening:
**Water Saci** is actively evolving a **WhatsApp Web worm** in **Brazil** that uses **HTA** and **PDF** lures to deliver a **banking trojan**. The latest wave shifts from **PowerS...
Augmented Marauder / Water Saci multi-pronged phishing campaign targeting Latin America and Europe
CampaignAbout this happening: **Water Saci** is actively evolving a **WhatsApp Web worm** in **Brazil** that uses **HTA** and **PDF** lures to deliver a **banking trojan**. The latest wave shifts from **PowerS...
FBI public warning on Signal and WhatsApp phishing
Public Sector Action
First: 20.03.2026 22:45
Last: 20.03.2026 22:45
Sources 1
About this happening:
The **FBI** issued a **public service announcement** warning that **Signal** and **WhatsApp** users are being targeted in **phishing campaigns**. The warning says the activity has...
FBI public warning on Signal and WhatsApp phishing
Public Sector ActionAbout this happening: The **FBI** issued a **public service announcement** warning that **Signal** and **WhatsApp** users are being targeted in **phishing campaigns**. The warning says the activity has...
SORVEPOTEL WhatsApp malware campaign spreads across Brazil
Campaign
First: 12.03.2026 19:31
Last: 12.03.2026 19:31
Sources 1
About this happening:
A **WhatsApp** malware campaign in **Brazil** is spreading **SORVEPOTEL**, a **self-propagating Windows malware** that uses **phishing ZIP attachments** and a desktop-only lure to...
SORVEPOTEL WhatsApp malware campaign spreads across Brazil
CampaignAbout this happening: A **WhatsApp** malware campaign in **Brazil** is spreading **SORVEPOTEL**, a **self-propagating Windows malware** that uses **phishing ZIP attachments** and a desktop-only lure to...
Meta rolls out anti-scam protections and AI scam detection across WhatsApp, Facebook, and Messenger
Security Tool/Service
First: 11.03.2026 15:29
Last: 11.03.2026 15:29
Sources 1
About this happening:
Meta is rolling out **anti-scam protections** across **WhatsApp, Facebook, and Messenger**, using warnings and AI detection to block scams before users engage. The updates target...
Meta rolls out anti-scam protections and AI scam detection across WhatsApp, Facebook, and Messenger
Security Tool/ServiceAbout this happening: Meta is rolling out **anti-scam protections** across **WhatsApp, Facebook, and Messenger**, using warnings and AI detection to block scams before users engage. The updates target...
Timeline
-
20.11.2025 13:30 2 articles · 6mo ago
HackOnChat WhatsApp hijacking campaign disclosed
Initial DisclosureCybersecurity researchers identified HackOnChat, a rapidly expanding global WhatsApp account-hijacking campaign that targets users worldwide through deceptive authentication portals and impersonation pages abusing WhatsApp Web. The campaign uses Session Hijacking and Account Takeover against active WhatsApp Web sessions, pushes fake security alerts, WhatsApp Web lookalike portals, and spoofed group-invite messages, and shows hundreds of incidents in recent weeks with a noticeable surge across the Middle East and Asia.
Show sources
- CTM360 Exposes a Global WhatsApp Hijacking Campaign: HackOnChat — thehackernews.com — 20.11.2025 13:30
- CTM360 Exposes a Global WhatsApp Hijacking Campaign: HackOnChat — thehackernews.com — 20.11.2025 13:30