CTM360 Exposes a Global WhatsApp Hijacking Campaign: HackOnChat

CTM360 has identified a rapidly expanding global WhatsApp account-hijacking campaign, internally dubbed HackOnChat, that targets users worldwide through a network of deceptive authentication portals and impersonation pages. According to CTM360, the operation abuses WhatsApp’s web interface and relies on social engineering to coax victims into compromising their accounts, with thousands of malicious URLs hosted on inexpensive top-level domains and rapidly generated via website builders.

The campaign’s activity logs show hundreds of incidents in recent weeks, with a surge across the Middle East and Asia. Two techniques dominate the attacks: Session Hijacking, which exploits linked-device functionality to hijack active WhatsApp Web sessions, and Account Takeover, which tricks victims into surrendering authentication keys for full control of their accounts.

Once a account is compromised, the attackers target the victim’s contacts to request money or sensitive information and may sift through messages and data for fraud or extortion, often spreading further via phishing messages from the hijacked account.