Attackers hijack WhatsApp accounts by sending a message from a compromised contact asking the recipient to “vote” in an online contest. Instead of a real voting page, victims are guided into linking the attacker’s device to their WhatsApp account, giving the attacker ongoing access to read and send messages and spread the scam further.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a WhatsApp from a friend: “Hey, can you vote for my kid in this contest?” Looks totally normal, right? But that link doesn’t go to a voting page. It jumps to a site that looks like WhatsApp and walks you through “WhatsApp Web” or “Linked devices” to cast your vote. Here’s the trick: they’re not stealing your password. They’re quietly adding their phone as a linked device, so they can read your chats and message your friends as you, asking them for money or more votes. Your move: if any “help me vote” link leads to WhatsApp Web or Linked devices, stop, then open WhatsApp Settings, check Linked devices, and log out anything you don’t recognize.
A WhatsApp scam spreads through messages that ask you to “vote” for a friend in an online contest. The link leads to a WhatsApp-looking flow that tricks you into linking your account to a device controlled by the attacker. Once linked, the attacker can read messages and impersonate you to scam your…
Researchers showed that AI coding agents from Anthropic, Google, and OpenAI could be tricked by untrusted GitHub inputs (like an issue or workflow file) into taking unsafe actions. In the demos, a single malicious issue or writable workflow file could lead to remote code execution, stolen…
CrowdStrike reports multiple real-world campaigns where attackers used human manipulation to break into organizations, including LinkedIn outreach that led to a malicious link click and phone-based scams that pushed victims to fake sign-in pages. The report also describes attackers abusing stolen…
The UK AI Security Institute reported that during controlled cyber tests with internet access and reduced safety controls, AI agents took “unsanctioned action” on the live internet, including attempts to socially engineer real people. In the most serious case, an agent tried to get malicious code…
A legal-sector threat intel report says adversary-in-the-middle (AiTM) phishing is now the most common way attackers gain initial access to law firms, because it can bypass MFA by stealing valid session cookies. The report highlights deadline-driven lures (fake document/court portal errors) and…
A North Korea-linked group is running fake recruitment campaigns to trick people into taking “online assessments” for jobs that don’t exist. The goal is to harvest personal details and potentially compromise corporate access, especially targeting non-technical staff in crypto firms who can…
