WhatsApp users are being urged to stay alert over a new scam that can hijack their private accounts. Security experts at Malwarebytes have spotted a concerning campaign targeting users of the Meta-owned service.
Scam spreads via fake polls
Messages are being sent to phones that initially seem harmless, with some even appearing to come from friends, family members or other trusted contacts. The texts typically ask the recipient to cast a vote in an online poll, perhaps for a school event, a competition or even the cutest pet.
It all sounds pretty innocuous, but there is no genuine vote waiting on the other side of the link. Instead, victims are taken to a fake WhatsApp webpage and asked to verify their account.
How the attack works
"A scam is spreading through WhatsApp with the goal of taking over victims’ accounts entirely," Malwarebytes confirmed. The security firm says the attack is designed to trick users into authorising a new linked device - such as a laptop or tablet - effectively giving the scammer access to their WhatsApp account.
Once hacked, criminals can potentially read private messages, steal personal information and target the victim's contacts. This can lead to convincing messages being sent to friends and family asking for money or sensitive information.
Hidden signs of compromise
What's particularly worrying is that there may be no obvious signs that an account has been hacked. Unlike some traditional attacks, victims may not receive password-reset emails or suspicious login alerts. Instead, the hacker's device simply appears as another linked product on the account.
That means the attack could remain hidden unless users take the time to check their linked devices. Malwarebytes is urging WhatsApp users to do exactly that.
Steps to protect yourself
Open WhatsApp and head to Settings > Linked Devices. Carefully check the list and immediately log out of anything you don't recognise. Users should also be extremely cautious about unexpected messages asking them to "vote" or "support" someone, even when they appear to have come from a friend or family member.
Never click on unexpected links, particularly if you're then asked to verify, connect or link your WhatsApp account. And perhaps most importantly, never follow instructions to link a new device or scan a QR code unless you started the process yourself.
