[Regnum] A global campaign to steal WhatsApp accounts (owned by Meta, a company designated as extremist and banned in Russia) is rapidly expanding and affecting users in dozens of countries. This was reported by Russian cybersecurity experts on December 2.
The large-scale hacking operation has been dubbed HackOnChat. According to experts, attackers are massively creating phishing websites that mimic WhatsApp Web, forcing users to undergo fake authentication. Thousands of malicious URLs and hundreds of confirmed cases of compromise have been identified in recent weeks.
Hackers are reportedly intercepting active web sessions through device linking and completely taking over accounts by obtaining access keys through fake notifications. Phishing resources automatically select country codes and adapt the language and interface to the region.
After gaining access to an account, attackers send messages impersonating the victim, collect personal and financial data, and distribute new phishing links, forming a chain of self-replicating attacks. Experts emphasize that social engineering and the spoofing of familiar interfaces remain the decisive factors.
Georgy Volkov, a member of the Public Council under the Russian Ministry of Digital Development, attributed the attacks' success to the service's device connection mechanism.
"WhatsApp's problem is that after scanning a QR code, the service immediately links the new device, without further confirmation. That's why the session hijacking scheme works so well. Could Meta do something about it? Yes, but the company categorically avoids anything that could complicate the interface or reduce profits," Volkov noted.
Nikita Danyuk, a member of the Civic Chamber of the Russian Federation and First Deputy Director of the Institute for Strategic Studies and Forecasts at RUDN University, added that the systemic security failures of Meta's services are understandable given the corporation's admission that it derives a significant portion of its revenue from fraudulent advertising. He added that this situation demonstrates that combating phishing and abuse is not a company priority, meaning attacks like HackOnChat will continue.
On November 21, the Russian information security portal SecurityLab reported that researchers from the University of Vienna gained unauthorized access to 3.5 billion WhatsApp user numbers in just a few hours. They found vulnerabilities in the web version of the messenger. The researchers noted that this issue had been discussed for eight years.
All the important news is in the Regnum channel in the MAX messenger.