WhatsApp linked-devices voting scam campaign
Campaign
Summary
Hide ▲
Show ▼
A WhatsApp scam campaign is using hijacked accounts and a fake contest-vote lure to get victims to authorize an attacker-controlled linked device, giving the operator full messaging access. Messages arrive from compromised contacts and route targets to pages that mimic WhatsApp or the wa.me flow. Once the link is added, attackers can read messages, send messages as the account holder, and push the same scam to the victim's contacts. The abuse avoids password prompts, so it can remain hidden unless users review linked devices.
Related Happenings
NSO Group WhatsApp spear-phishing campaign
Campaign
H score37
First: 08.06.2026 20:08
Last: 08.06.2026 20:08
Sources 1
About this happening:
NSO Group remains tied to a WhatsApp spear-phishing campaign that used malicious links to push targets to external websites outside the app. On June 8, WhatsAp...
NSO Group WhatsApp spear-phishing campaign
CampaignAbout this happening: NSO Group remains tied to a WhatsApp spear-phishing campaign that used malicious links to push targets to external websites outside the app. On June 8, WhatsAp...
Signal adds in-app phishing confirmations and warning messages
Security Tool/Service
H score14
First: 12.05.2026 22:40
Last: 12.05.2026 22:40
Sources 1
About this happening:
Signal added in-app confirmations and warning messages to slow phishing and social-engineering attempts that could expose accounts, chats, and contacts. Th...
Signal adds in-app phishing confirmations and warning messages
Security Tool/ServiceAbout this happening: Signal added in-app confirmations and warning messages to slow phishing and social-engineering attempts that could expose accounts, chats, and contacts. Th...
Suspected Russia-linked Signal phishing campaign targeting political accounts
Campaign
H score18
First: 28.04.2026 13:54
Last: 28.04.2026 13:54
Sources 1
About this happening:
A suspected Russia-linked phishing campaign on Signal compromised about 300 political-sphere accounts, exposing chats, ongoing conversations, and address books. Victim...
Suspected Russia-linked Signal phishing campaign targeting political accounts
CampaignAbout this happening: A suspected Russia-linked phishing campaign on Signal compromised about 300 political-sphere accounts, exposing chats, ongoing conversations, and address books. Victim...
Latest development: 12.05.2026 22:40
Signal introduced new in-app confirmations, warning messages, and educational prompts to help users resist phishing and social engineering attempts, including bogus Signal Support lures and requests to scan QR codes or share registration codes, PINs, or recovery keys.
Unnamed high-profile Lebanese journalist hit by network compromise
Incident
H score10
First: 09.04.2026 13:45
Last: 09.04.2026 13:45
Sources 1
About this happening:
An unnamed high-profile Lebanese journalist had an Apple account successfully compromised in 2025, creating unauthorized access to a personal and professional identity...
Unnamed high-profile Lebanese journalist hit by network compromise
IncidentAbout this happening: An unnamed high-profile Lebanese journalist had an Apple account successfully compromised in 2025, creating unauthorized access to a personal and professional identity...
Bitter Middle East spear-phishing campaign targeting civil society figures
Campaign
H score28
First: 09.04.2026 13:45
Last: 09.04.2026 13:45
Sources 1
About this happening:
A spear-phishing campaign targeted civil society figures in Middle Eastern countries, including three journalists in Egypt and Lebanon, creating account-compromise ris...
Bitter Middle East spear-phishing campaign targeting civil society figures
CampaignAbout this happening: A spear-phishing campaign targeted civil society figures in Middle Eastern countries, including three journalists in Egypt and Lebanon, creating account-compromise ris...
Timeline
-
03.08.2026 03:00 2 articles · 1d ago
WhatsApp scam uses hijacked accounts to add attacker-linked devices
Initial DisclosureCompromised WhatsApp accounts send contest-vote messages to contacts, luring recipients to a page that resembles WhatsApp and often uses the legitimate wa.me domain or to a flow that asks for a linking code, so an attacker’s device is added as a linked session. Once linked, the attacker can read and send messages as the account holder, forward the same scam to contacts, and ask friends and family for money, while avoiding password-reset and failed-sign-in alerts because no password is used.
Show sources
- WhatsApp Scam Hijacks Accounts via Linked Devices Feature — www.infosecurity-magazine.com — 04.08.2026 17:30
- WhatsApp Scam Hijacks Accounts via Linked Devices Feature — www.infosecurity-magazine.com — 04.08.2026 17:30