WhatsApp Users Targeted in Phishing Wave Involving Fake Voting Links
Cybercriminals are exploiting user trust through a rising wave of WhatsApp account takeovers disguised as requests to vote in children’s competitions, according to recent warnings from security authorities. Betrüger auf WhatsApp sind ein großes Problem, as security authorities note, with the Bundesamt für Cybersicherheit registering more than 50 reports concerning the voting scam in October alone following a wave of successful attacks.
The attack typically begins when a user receives a message from a familiar contact asking for assistance in a school or dance contest. Victims are directed to a phishing website designed to resemble a legitimate voting portal. Die Adressen wechseln ständig, damit Sicherheitsfilter nicht anschlagen, as security analysts point out regarding the frequently changing URLs designed to bypass security filters.
Once on the malicious site, targets encounter two primary avenues for compromise. In the first scenario, victims enter their mobile phone number followed by the six-digit SMS registration code sent by WhatsApp. Entering this code effectively registers the account on the attackers’ device, locking out the original owner. In the second scenario, the site displays a QR code accompanied by instructions to scan it via the WhatsApp “Linked Devices” menu. This action covertly pairs the victim’s account with the fraudsters’ system through the application’s multi-device feature.
Financial Fraud and Secondary Attacks Follow Account Hijacking
After seizing control of an account, perpetrators immediately use the compromised profile to expand their reach and extract funds. Das Landeskriminalamt in Schleswig-Holstein berichtete, dass Kriminelle in vermeintlichen Notlagen wie einer akuten Arztbehandlung angeblich Geld benötigen und einen Überweisungslink an Kontakte schicken. In several documented instances, these follow-up messages have led to substantial financial losses for unsuspecting friends and family members who assumed they were helping a trusted acquaintance. In one case reported by the police in Schalksmühle, a hacker demanded a bank transfer of 430 euros under the pretext of a reached card limit, which the victim’s brother almost executed via instant transfer before the message was deleted from the chat.
Attackers rely on artificial time pressure and emotionally charged appeals, such as tight deadlines for a child’s competition, to prevent targets from verifying the request through an independent phone call or alternate channel.
Mitigation Strategies and Account Recovery Steps
Security agencies outline specific technical safeguards to prevent unauthorized access and recover hijacked profiles. Users are advised never to share the six-digit registration code or scan unfamiliar QR codes found on external websites. Enabling two-step verification within WhatsApp creates a dedicated PIN that makes account hijacking significantly more difficult.
For individuals whose accounts have already been compromised, authorities recommend immediate action:
- Notify contacts through an alternative communication channel to warn them against clicking suspicious links sent from the hijacked profile.
- Go to Settings, select Linked Devices, and immediately log out any unrecognized sessions.
- Re-register the mobile number on the official WhatsApp application to automatically invalidate the attackers’ session via a new SMS code. If the criminals have already established a custom PIN, the legitimate owner must wait a mandatory seven-day period during which both parties remain locked out before regaining control.
- Sofort die Nachricht löschen, when receiving unsolicited voting links, and never disclose personal phone numbers or data upon such requests.
Hijacked Profiles Automatically Send Fraudulent Requests to Contacts
The rapid spread of the campaign is driven by a snowball effect, as hijacked profiles automatically dispatch the fraudulent request to every entry in the victim’s address book. The messages typically ask for a vote for a child with names such as Sophia, Sofia, or Eliska.
Keep reading