This WhatsApp Link Can Hand Over Your Account in Seconds

A sophisticated phishing campaign attributed to Iranian Revolutionary Guards intelligence is using a fake WhatsApp Web login hosted on DuckDNS to push live QR codes to victims; when scanned, the attacker’s browser session is authenticated, enabling full WhatsApp account takeover and, if granted, remote activation of camera, microphone and location for ongoing surveillance. The campaign targets individuals abroad involved in political, media, activist, or research work related to Iran and was documented by researcher Nariman Gharib with corroborating media coverage.