Over the last few months, security teams around the world have been tracking a wave of WhatsApp hijacking attempts that feels a bit different from the usual scams. This time, attackers aren’t relying on fancy malware or highly technical exploits. Instead, they’re going after something much more vulnerable, people.
The campaign has been spreading across multiple regions at the same time, and the pattern is almost always the same: the attacker tricks the victim into handing over the six digit WhatsApp verification code. Sometimes it’s done through a seemingly harmless message from a “friend,” other times through calls pretending to be customer support. The attackers don’t need much. Once they get that code, they can take over the account within seconds.
In some cases, hijackers use the account immediately to scam the victim’s contacts. In others, they change the linked number or use SIM swap techniques to gain longer term control. What makes this campaign particularly worrying is how coordinated and widespread it is. Security researchers have reported similar tactics appearing in different countries at nearly the same time, suggesting that organized groups not random scammers are behind it.
What’s more frustrating is that many people still believe, “It’s just WhatsApp, what’s the worst that could happen?” But when your WhatsApp is tied to your identity, your business communications, your friends, clients, and even two factor authentication codes, losing access becomes a real security risk.
So, what can users actually do?
The first and most important step is enabling two step verification inside WhatsApp. It sounds basic, but this one small setting blocks the majority of takeover attempts. The second step is simple awareness, never share your verification code with anyone, not even someone you think you know. If a message feels off, pause. Call the person directly. Verify.
This global hijacking campaign is a reminder that cyberattacks aren’t always technical. Sometimes the weakest point isn’t the app, it’s the human behind the screen.
