Attackers hijack WhatsApp accounts by sending a message from a compromised contact asking the recipient to “vote” in an online contest. Instead of a real voting page, victims are guided into linking the attacker’s device to their WhatsApp account, giving the attacker ongoing access to read and send messages and spread the scam further.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a WhatsApp from a friend: “Hey, can you vote for my kid in this contest?” Looks totally normal, right? But that link doesn’t go to a voting page. It jumps to a site that looks like WhatsApp and walks you through “WhatsApp Web” or “Linked devices” to cast your vote. Here’s the trick: they’re not stealing your password. They’re quietly adding their phone as a linked device, so they can read your chats and message your friends as you, asking them for money or more votes. Your move: if any “help me vote” link leads to WhatsApp Web or Linked devices, stop, then open WhatsApp Settings, check Linked devices, and log out anything you don’t recognize.
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
This threat trend report describes multiple real-world APT campaigns where attackers rely on social engineering and trusted services (Zoom/Teams, Telegram, webmail, GitHub) to steal credentials and access cloud accounts. Notable examples include fake meeting lures to deliver malware, and abuse of…
The FBI says criminals are using social engineering to take over social media accounts, steal explicit content, and sell or post it online along with victims’ personal information. Reported tactics include pretending to be a social media company representative, spamming victims with password-reset…
League of Legends players report bot accounts sending friend requests right after matches, opening with flattery, and quickly moving the chat to Discord. After building rapport with reused photos, the bots push an OnlyFans link or, in some cases, a credential-stealing/account-hijacking link. The…
A phishing campaign targets YouTube creators with a fake, invite-only Amazon Music advertising deal. The fraudulent site uses each creator’s real public channel statistics to appear legitimate, then places a fake Google sign-in screen over the page to capture Google passwords and multi-factor…
