Nowadays if one of your contacts wants to ask you for a favor on WhatsApp, you better tell them: thanks but no thanks. It’s easy to distrust when someone asks us for money, even if they’re pretending to be our son and their phone is supposedly broken (not having kids makes it a lot easier), but when what they want is something as simple, quick, and preferentially innocent as a dance contest vote, things change.
At that moment a phrase is running through my mind (“Oh, girl, it doesn’t cost a thing”) suggesting that I waste that minute voting, thank God that being lazy works for me in this regard, but I am aware that not everyone is so mean, especially since the message comes from one of your acquaintances, who could be your bosom friend. Besides pleasing a child and his parents, it also promises a free dance class. And you do it.
A link is not what it says. The link leads to a website that simulates a poll, asking for phone numbers and showing a code with instructions to enter it on WhatsApp. Hint: This is the information needed to link an external device to an account, which INCIBE explains, will allow you to write to your contacts without authorization and, for example, continue to forward these same messages to your contacts, increasing the network of potential victims.
We are facing a ghost-pairing scam and it works when you use WhatsApp Web on your computer because of what you are actually doing and what the people behind it access: your chats, contacts, what you share and what they share with you.
Even if you’re in a hurry to fool your acquaintances or want to learn to dance: don’t vote for Eliska
It’s just the beginning. There is no malware involved in this scam, but access to large amounts of sensitive and personal data and hijacking your account, which cybercriminals can use to spread fraudulent messages and requests for money. Without further ado, a request for money in an emergency (for example, a visit to the dentist that is much more expensive than expected) seems much more credible if it comes from a contact than if it comes from an unknown number. For example, if it comes from your son or daughter.
In fact, INCIBE warned a few days ago about using contact accounts to request money from their contacts and provide an account number in supposed emergencies. And be careful because it’s working for them: according to BitDefender, 177 fraudulent domains and 554 unique URLs have been identified as linked to this social engineering campaign.
What should I do if I receive this message? Better not to open the link and if you do, don’t provide your number or follow the instructions. The National Cybersecurity Institute asks you to report it with screenshots and delete the chat later. To avoid the risk of impersonation, it is better to enable WhatsApp two-step verification (go to your settings and ‘Account’ > ‘Two-step verification’ and enable the option).
If you have “already voted” and therefore entered your number, go back to ‘Settings’ > ‘Linked Devices’ and close all sessions you don’t know about, in addition to informing INCIBE and the authorities. And if someone you know asks you for money via chat, all you can do is verify through another channel, even just by calling.
In Xataka | WhatsApp Transient Photo Scam: What It Is & How To Avoid Getting Extorted With It
In Xataka | Spam Messages on WhatsApp: What They Are, What Scams Can Reach You From Unknown Numbers, and What You Can Do About It
cover WhatsApp with ChatGPT
