A phishing campaign is impersonating the WhatsApp Security Centre to hijack accounts by tricking users into clicking malicious links, scanning fraudulent QR codes, or entering codes into the "Linked devices" function. The article does not specify a software vulnerability, CVSS score, or affected versions, as this is a social engineering threat targeting user behavior rather than a technical flaw in WhatsApp. The primary workaround is user education and adherence to the provided security recommendations, such as enabling two-step verification, reviewing linked devices, and verifying unusual requests through other channels.
Solutions Security Recommendations The public is advised to take the following precautions: Do not trust messages claiming that your WhatsApp account has been locked and asking you to click on a link for verification or recovery Do not scan unknown QR codes or enter codes provided by websites into WhatsApp’s Linked devices function Do not follow unsolicited instructions to use Link with phone number in WhatsApp Verify account-related alerts only through official WhatsApp channels Regularly review the devices linked to your WhatsApp account and remove any unrecognised devices immediately Enable two-step verification in WhatsApp to strengthen account security Remain cautious of messages creating a false sense of urgency, such as claims involving account suspension or security issues When receiving unusual requests from friends or family through instant messaging applications, such as requests to borrow money, provide verification codes, or click on links, verify their identity through other means first Only download and install instant messaging applications from official app stores, and avoid using modified or untrusted versions Keep instant messaging applications and device operating systems up to date, and apply security updates promptly, to reduce the risk of hackers compromising accounts or devices by exploiting known vulnerabilities If You Suspect Your WhatsApp Account Has Been Compromised Users who may have followed the phishing instructions should take the following actions immediately: Open WhatsApp and review Settings → Linked devices Remove any unfamiliar linked devices Enable or reset two-step verification Inform contacts that the account may have been compromised Monitor the account for suspicious activities or messages Seek assistance through official WhatsApp support channels where necessary Businesses or members of the public who wish to report to HKCERT on information security related incidents such as malware, phishing, denial of service attacks, etc. can do so by completing the online form at: https://www.hkcert.org/incident-reporting , or calling the 24-hour hotline at +852 8105 6060. For further enquiries, please contact HKCERT at hkcert@hkcert.org .