HackOnChat WhatsApp account-hijacking campaign
Campaign
Summary
Hide ▲
Show ▼
The HackOnChat operation is rapidly expanding a WhatsApp account-hijacking campaign that steals access through deceptive authentication portals and impersonation pages. It has generated thousands of malicious URLs and hundreds of incidents in recent weeks, showing broad operational scale. The activity is spreading across the Middle East and Asia and puts users at risk of account takeover, fraud, and downstream phishing from compromised accounts.
Related Happenings
DCloud Uni-App scam website campaign
Campaign
H score70
First: 29.06.2026 14:57
Last: 29.06.2026 14:57
Sources 1
About this happening:
The **DCloud Uni-App** scam-site campaign has grown into a **236,493-domain** fraud network that steals credentials, drains crypto wallets, and impersonates major brands. The site...
DCloud Uni-App scam website campaign
CampaignAbout this happening: The **DCloud Uni-App** scam-site campaign has grown into a **236,493-domain** fraud network that steals credentials, drains crypto wallets, and impersonates major brands. The site...
Russian intelligence services fake support SMS messaging-account phishing campaign
Campaign
H score29
First: 27.06.2026 20:27
Last: 27.06.2026 20:27
Sources 1
About this happening:
A **long-running phishing campaign** by **Russian intelligence services** is stealing **messaging-account credentials** from officials, military personnel, politicians, and activi...
Russian intelligence services fake support SMS messaging-account phishing campaign
CampaignAbout this happening: A **long-running phishing campaign** by **Russian intelligence services** is stealing **messaging-account credentials** from officials, military personnel, politicians, and activi...
WhatsApp VBScript phishing campaign targeting users in multiple countries
Campaign
H score43
First: 23.06.2026 01:42
Last: 23.06.2026 01:42
Sources 1
About this happening:
An **ongoing phishing campaign** is using **compromised WhatsApp accounts** to send **obfuscated VBScript files** to users in **multiple countries**, creating a path to **remote s...
WhatsApp VBScript phishing campaign targeting users in multiple countries
CampaignAbout this happening: An **ongoing phishing campaign** is using **compromised WhatsApp accounts** to send **obfuscated VBScript files** to users in **multiple countries**, creating a path to **remote s...
NSO Group WhatsApp spear-phishing campaign
Campaign
H score37
First: 08.06.2026 20:08
Last: 08.06.2026 20:08
Sources 1
About this happening:
**NSO Group** remains tied to a **WhatsApp** spear-phishing **campaign** that used **malicious links** to push targets to external websites outside the app. On **June 8**, WhatsAp...
NSO Group WhatsApp spear-phishing campaign
CampaignAbout this happening: **NSO Group** remains tied to a **WhatsApp** spear-phishing **campaign** that used **malicious links** to push targets to external websites outside the app. On **June 8**, WhatsAp...
TA4922 expanded European phishing-and-malware campaign
Campaign
H score40
First: 04.06.2026 00:45
Last: 04.06.2026 00:45
Sources 1
About this happening:
**TA4922** is a **China-linked** cybercrime campaign that has expanded from **East Asia** into **Europe and Africa**, including **the U.K., Germany, Italy, and South Africa**. The...
TA4922 expanded European phishing-and-malware campaign
CampaignAbout this happening: **TA4922** is a **China-linked** cybercrime campaign that has expanded from **East Asia** into **Europe and Africa**, including **the U.K., Germany, Italy, and South Africa**. The...
Timeline
-
20.11.2025 13:30 2 articles · 7mo ago
HackOnChat WhatsApp hijacking campaign disclosed
Initial DisclosureCybersecurity researchers identified HackOnChat, a rapidly expanding global WhatsApp account-hijacking campaign that targets users worldwide through deceptive authentication portals and impersonation pages abusing WhatsApp Web. The campaign uses Session Hijacking and Account Takeover against active WhatsApp Web sessions, pushes fake security alerts, WhatsApp Web lookalike portals, and spoofed group-invite messages, and shows hundreds of incidents in recent weeks with a noticeable surge across the Middle East and Asia.
Show sources
- CTM360 Exposes a Global WhatsApp Hijacking Campaign: HackOnChat — thehackernews.com — 20.11.2025 13:30
- CTM360 Exposes a Global WhatsApp Hijacking Campaign: HackOnChat — thehackernews.com — 20.11.2025 13:30