WhatsApp Hijackings Surge: Experts Urge Phone Updates Now
(MENAFN) Cybersecurity specialists are sounding the alarm over a rise in WhatsApp account takeovers and fraud attempts, urging users to keep their phone software current to close the gaps criminals exploit.
Attack methods are growing more sophisticated in Türkiye and around the world, with the messaging app a prime target. Once inside an account, hackers can copy the owner’s writing style and message friends and family, posing as the victim and pleading for urgent bank-transfer loans.
Ibrahim Gunduzgil, head of the cybersecurity program at Istanbul Commerce University, told a Turkish state-run news agency that criminals break into accounts through phishing, including fake links, and through social engineering.
“Security vulnerabilities in outdated apps or operating systems can be exploited by attackers, posing an additional risk through the exploitation of known vulnerabilities,” he said, adding that the same tactics can be used to take over active sessions on Telegram and comparable apps. Gunduzgil said the root of the problem is a mix of technical flaws and user behavior.
He urged users to switch on two-factor authentication and other extra protections, and never to hand over verification codes sent by SMS or any other channel. He also recommended reviewing linked devices and active sessions, and removing any that are unfamiliar.
“Users who suspect their accounts have been compromised must immediately begin the recovery process and notify their close contacts,” he said. Gunduzgil added that anyone asked outright for money should confirm the requester’s identity through a different channel.
The weaknesses behind these takeovers are not confined to Android or iOS, Gunduzgil said, though recent reports point to iOS devices running outdated software as vulnerable. WhatsApp Web sessions left open on untrusted computers, along with malware and fake QR codes, can also give attackers unauthorized entry.
“Users can continue using their messaging apps without realizing it, but the attacker can access their apps from another device, so users must ensure the security of their phones, computers and other devices linked to their accounts,” he said.
Sabri Erdemir, head of the computer programming department at Istanbul Commerce University, also spoke to the news agency. He said victims should preserve evidence: screenshots of suspicious messages, links, phone numbers and bank account details used in money requests, transfer receipts, and the date and time of the incident.
Erdemir cautioned that cutting off internet access on an affected device does not stop an attack, because intruders can reach the account from another device.
“The compromised device should not be reset to factory settings, apps must not be uninstalled, and existing records must be preserved,” he said. A reset, he noted, could wipe forensic traces of the attack and fraud attempts that investigators need to identify those responsible.
“Relevant banks must be contacted immediately in the event of financial loss,” he added. Erdemir said victims should also report the incident to law enforcement even if they lost no money, since preserved evidence can help identify the perpetrators and keep the hijacked account from being misused again.
Attack methods are growing more sophisticated in Türkiye and around the world, with the messaging app a prime target. Once inside an account, hackers can copy the owner’s writing style and message friends and family, posing as the victim and pleading for urgent bank-transfer loans.
Ibrahim Gunduzgil, head of the cybersecurity program at Istanbul Commerce University, told a Turkish state-run news agency that criminals break into accounts through phishing, including fake links, and through social engineering.
“Security vulnerabilities in outdated apps or operating systems can be exploited by attackers, posing an additional risk through the exploitation of known vulnerabilities,” he said, adding that the same tactics can be used to take over active sessions on Telegram and comparable apps. Gunduzgil said the root of the problem is a mix of technical flaws and user behavior.
He urged users to switch on two-factor authentication and other extra protections, and never to hand over verification codes sent by SMS or any other channel. He also recommended reviewing linked devices and active sessions, and removing any that are unfamiliar.
“Users who suspect their accounts have been compromised must immediately begin the recovery process and notify their close contacts,” he said. Gunduzgil added that anyone asked outright for money should confirm the requester’s identity through a different channel.
The weaknesses behind these takeovers are not confined to Android or iOS, Gunduzgil said, though recent reports point to iOS devices running outdated software as vulnerable. WhatsApp Web sessions left open on untrusted computers, along with malware and fake QR codes, can also give attackers unauthorized entry.
“Users can continue using their messaging apps without realizing it, but the attacker can access their apps from another device, so users must ensure the security of their phones, computers and other devices linked to their accounts,” he said.
Sabri Erdemir, head of the computer programming department at Istanbul Commerce University, also spoke to the news agency. He said victims should preserve evidence: screenshots of suspicious messages, links, phone numbers and bank account details used in money requests, transfer receipts, and the date and time of the incident.
Erdemir cautioned that cutting off internet access on an affected device does not stop an attack, because intruders can reach the account from another device.
“The compromised device should not be reset to factory settings, apps must not be uninstalled, and existing records must be preserved,” he said. A reset, he noted, could wipe forensic traces of the attack and fraud attempts that investigators need to identify those responsible.
“Relevant banks must be contacted immediately in the event of financial loss,” he added. Erdemir said victims should also report the incident to law enforcement even if they lost no money, since preserved evidence can help identify the perpetrators and keep the hijacked account from being misused again.
Legal Disclaimer:
MENAFN provides the
information “as is” without warranty of any kind. We do not accept
any responsibility or liability for the accuracy, content, images,
videos, licenses, completeness, legality, or reliability of the information
contained in this article. If you have any complaints or copyright
issues related to this article, kindly contact the provider above.
Comments
No comment