Beware: New Whatsapp scam doing the rounds

Muscat: A new phishing campaign targeting WhatsApp users through a fraudulent voting scheme has been discovered. This attack lures victims with a voting page allegedly featuring young athletes, but other voting topics are being exploited as well, says Kaspersky.

“The method can be easily tuned for different scenarios, and the ultimate goal of the attackers is to hijack WhatsApp accounts,” the company warns.

Elaborating on the way Kaspersy says the scam begins with users being directed to a seemingly legitimate webpage claiming to host a voting contest. For instance, the page can feature photos of athletes, each accompanied by a “Vote” button and real-time counters displaying alleged vote totals and the number of users who have participated.

These elements create a false sense of authenticity, encouraging user engagement. The page also claims that anyone can participate in the contest after “authorisation”, with winners getting prizes from “sponsors”. 

Upon clicking either “Vote” or “Authorise” buttons, users are redirected to a fraudulent webpage that encourages users to “quickly and simply” authorise via WhatsApp. Users are prompted to enter their WhatsApp-associated mobile phone number.

Attackers then use the WhatsApp feature to login into the messenger’s web interface via a one-time code: they input the victim’s phone number to login to WhatsApp Web and the system gives out a 6-digit code which the scam website then mirrors. 

Kaspersky further says when the user inputs this code in the app on their smartphone, the web session that the attackers initiated goes live, allowing them to spy on the victim, write messages and eventually take over the account. 

To protected from such hijacking scams, Kaspersky recommends the following: 
* Enable two-step verification: Activate WhatsApp’s two-step verification feature to add an extra layer of security, requiring a PIN for account access.   

* Verify website authenticity: Avoid entering personal information on unfamiliar websites, especially those reached via unsolicited links. Always check the URL for legitimacy. 

* Never share verification codes: WhatsApp will never ask for your verification code. Do not share it with anyone, or accept it from anyone, even if prompted by a seemingly trusted source. 

* Use trusted and proven security software to detect and block malicious websites and links.