A WhatsApp scam has been spreading through hijacked accounts by asking recipients to vote for a friend in an online contest, then tricking them into authorizing an attacker’s device on their own account.
In new research published by Malwarebytes on August 3, the company showed how the messages arrived from contacts whose accounts were already compromised and referenced a ballet performance, a dog competition or a school event. The company spotted the campaign in anonymized submissions to its scam-checking tool.
The link did not lead to a voting page. It redirected to a page resembling WhatsApp, often using the legitimate wa.me domain, which guided the victim through what looked like setting up WhatsApp Web. Other versions simply instructed the target to open their linked device settings and enter a code the scammer supplied.
Read more on messaging scams: NCSC Issues Security Alert Over Hackers Targeting WhatsApp and Signal Accounts
No Password, No Alert
The attackers were not after credentials. Completing the flow added their device as a linked session, giving them the same access a legitimate second device would have.
That meant reading messages, sending messages as the account holder and following conversations in real time. Attackers used it to forward the same scam to the victim’s contacts and to ask friends and family for money.
Because no login took place, there were no password reset emails or failed sign-in alerts. The attacker’s device appeared as another entry in the linked devices list, and Malwarebytes said the compromise could go unnoticed for some time unless the user checked.
A Familiar Technique, A New Lure
Abuse of the linked devices feature is not new. Researchers documented the same mechanism in December 2025 under the name GhostPairing, using fake photo-viewer pages rather than voting requests.
Russian state actors have used QR code and device-linking lures against WhatsApp and Signal users in the past.
What has changed is the pretext. A request to help someone’s child or pet win a contest is low-stakes, plausible and comes from a real contact, which Malwarebytes said combined trust and curiosity effectively.
The company advised users to review Settings then Linked devices and log out anything unfamiliar, never to scan a QR code or enter a linking code they did not initiate and to verify unexpected requests through another channel.
Anyone already affected should log out all linked devices and warn their contacts.
