Phishing Campaign Targets WhatsApp Accounts

Researchers report a phishing campaign that lures users with a message like “Hey, I just found your photo!” linking to a spoofed Facebook page which either shows a QR code or asks for the user’s phone number. The malicious page forwards the number to WhatsApp’s legitimate device-linking flow, captures the generated pairing code, and convinces victims to enter it into WhatsApp—thereby pairing a malicious device and giving attackers full access to the victim’s WhatsApp account for follow-on phishing and abuse.