WhatsApp users must be on red alert and check their phone settings after the discovery of a worrying new text message scam.
How the scam works
As spotted by security experts at Malwarebytes, the new texts appear harmless enough and can even arrive via close contacts, family or friends whose accounts have already been compromised. Once opened, it simply asks users to take part in a vote, such as a school event or which pet is the cutest.
However, once clicked, there is no real voting page. Instead, the links lead to fake WhatsApp webpages where users are prompted to verify their accounts.
Account takeover risk
"A scam is spreading through WhatsApp with the goal of taking over victims’ accounts entirely," Malwarebytes explained. "It starts with a message that feels harmless and familiar. Someone—often a contact whose account has already been compromised—asks you to support a friend or relative of theirs by voting in an online contest."
"The goal is to trick you into authorising a new linked session that gives the attacker access to your WhatsApp account," Malwarebytes explains.
Impact on victims
Those who are fooled then hand over access to hackers who can then read personal messages, harvest data, and attack other users in their contacts list. This attack also lets the cyber crooks message friends and family asking them for money or sensitive information.
It's more worrying than some other threats because it doesn’t involve a traditional login, and there are no obvious signs like password reset emails or failed login alerts. The attacker’s device simply appears as another linked session on an account.
Protect yourself
So, unless users check their linked devices, the compromise can go unnoticed for quite some time. Malwarebytes now says it's vital that users head to their settings and review their linked devices. You can do this by going to Settings > Linked devices and logging out of any you don’t recognise.
It's also wise to be cautious when getting any texts that ask you to “vote” or “support” requests, even if they come from someone you know.
Two other top tips include not clicking on unexpected links, especially if you’re immediately asked to verify, connect, or link your WhatsApp account. Also, never follow instructions to link devices or scan QR codes unless you initiated the action yourself.
