A WhatsApp scam spreads through messages that ask you to “vote” for a friend in an online contest. The link leads to a WhatsApp-looking flow that tricks you into linking your account to a device controlled by the attacker. Once linked, the attacker can read messages and impersonate you to scam your contacts.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a WhatsApp from a friend: “Hey, can you vote for my cousin in this contest?” Looks harmless, right? But the link doesn’t go to a voting page. It jumps into a WhatsApp-looking wa.me flow that pushes you to ‘continue’ or ‘connect’ your WhatsApp. Some versions even tell you: “open WhatsApp, go to Connected or Linked Devices, and enter this code.” That quietly links the scammer’s device to your WhatsApp so they can read and send messages as you. If a contact asks you to vote and you see any ‘verify, connect, or link your WhatsApp’ step, stop. Message them back on a different channel to confirm before you touch anything.
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
This article describes real election-themed scams that use fake voter-support messages, political donation appeals, survey prizes, official-looking penalty notices, and bogus campaign merchandise. The scams pressure voters to click fraudulent links, share personal or payment information, download…
Following a Revolut data breach, scammers sent text messages that appeared to come from the same message thread as legitimate Revolut texts. The texts pushed victims to click a link for a fake identity “liveness check,” request camera access, and then capture passwords, information that could be…
A phishing campaign targets YouTube creators with a fake, invite-only Amazon Music advertising deal. The fraudulent site uses each creator’s real public channel statistics to appear legitimate, then places a fake Google sign-in screen over the page to capture Google passwords and multi-factor…
Microsoft says it uncovered and disrupted an underground marketplace (“YAM Store”) that sold phishing kits and access to cloud accounts, enabling massive global phishing and SMS scam campaigns. The operation allegedly supported over a billion scam messages since January 2026 and targeted 75,000+…
A recent scam targets YouTube creators with personalized “paid collaboration” emails that impersonate well-known brands and push victims to a fake collaboration platform. The site then routes victims to a Google sign-in step that can capture credentials or trick users into granting dangerous…
