Authorities Warn Of Wave Of WhatsApp Account Hijacking Via Fake Contests

Swiss Federal Office for Cybersecurity Registers Over 50 WhatsApp Vote Scams in October

European security agencies issued warnings in October 2026 regarding a coordinated wave of account takeover attacks targeting WhatsApp users through fake online voting prompts. The Swiss Federal Office for Cybersecurity (BACS) registered more than 50 official reports specifically concerning fraudulent competition voting scams during the month of October alone. That figure captures only direct reports submitted to BACS and does not reflect the total volume of incidents across Switzerland.

The Tech TL;DR:

• Attackers compromise contacts’ address books to send fake voting requests for fictional children’s dance contestants like “Eliska” or “Sophie” via URLs such as academybalet.lat and fibsdance.site.
• Victims are prompted to enter phone numbers and SMS verification codes, or scan malicious QR codes using WhatsApp’s “Linked Devices” feature, allowing attackers to hijack accounts.
• Security authorities recommend enabling two-step verification, auditing linked devices, and immediately warning contacts via alternative channels if an account is compromised.

The fraudulent campaign relies on social engineering via compromised contact lists. As the Spanish Policía Nacional noted, the attackers send messages in the name of known contacts—such as partners, parents, or siblings—asking for support in online dance contests for fictional participants like “Eliska, la niña bailarina.” Once an account falls victim to the exploit, the automated system immediately forwards the exact same malicious message to every contact stored in the address book.

Technical analysis reveals two primary attack vectors utilized by the threat actors. The French Gendarmerie nationale and BACS identified instances involving the theft of standard SMS registration codes alongside QR code exploitation via the WhatsApp “Linked Devices” menu. When a fresh device registration occurs, WhatsApp automatically logs out other previously active sessions. If attackers simultaneously configure a custom two-step verification PIN on the hijacked account, the legitimate owner faces a mandatory seven-day lockout period.

Investigators observed that many affected devices were iPhones lacking the most recent operating system updates, creating an entry point for the exploit. Beyond account hijacking, perpetrators frequently pivot to financial fraud. The Spanish police documented cases where criminals used seized accounts to request funds via bank transfers or the Bizum payment service, citing fabricated emergencies such as reaching transaction limits.

Security agencies advise users to verify unexpected requests through phone calls, ignore unverified links, and never share SMS verification codes or confirm unsolicited device linkages. Anyone experiencing financial loss or unauthorized transfers should contact their bank immediately, while victims of account compromise should warn contacts via alternative channels and file a report.

How attackers hijack WhatsApp accounts using voting links?

How do attackers hijack a WhatsApp account using a voting link?

Attackers direct victims from a compromised contact’s message to a fake voting portal like academybalet.lat or fibsdance.site. Once there, users are asked to input their phone number and an SMS verification code, or scan a malicious QR code. Providing these credentials lets the attackers register the victim’s phone number on their own device and take control of the account.

What steps can users take to secure WhatsApp against these exploits?

Users should activate two-step verification in the WhatsApp settings, regularly review the “Linked Devices” menu to terminate unauthorized sessions, and keep both their operating system and messaging application updated to the latest version.

Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.