Kaspersky has discovered a phishing campaign targeting WhatsApp users via a fake voting scheme. Victims are lured to a fraudulent voting page featuring photos of athletes and enticing prizes. This page claims participants can vote after “authorisation.”
Clicking “Vote” or “Authorise” redirects users to a deceptive site asking for their WhatsApp number. Attackers then use this information to access WhatsApp Web via a one-time code, allowing them to monitor the victim’s account, send messages, and take control.
“We see that online contests that include voting are very popular now, and this is used by attackers who exploit trust in this seemingly harmless activity. By combining social engineering with convincing fake interfaces, attackers are weaponising user engagement to steal sensitive data. Awareness and vigilance are critical to staying safe,” comments Tatyana Shcherbakova, Web Content Analyst at Kaspersky.
Kaspersky is recommending to be protected from hijacking scams, follow the steps:
- Enable two-step verification: Activate WhatsApp’s two-step verification feature to add an extra layer of security, requiring a PIN for account access.
- Verify website authenticity: Avoid entering personal information on unfamiliar websites, especially those reached via unsolicited links. Always check the URL for legitimacy.
- Never share verification codes: WhatsApp will never ask for your verification code. Do not share it with anyone, or accept it from anyone, even if prompted by a seemingly trusted source.
- Use trusted and proven security software to detect and block malicious websites and links.