WhatsApp Hackers Use Fake Online Votes to Silently Take Over Accounts
Amsterdam, Saturday, 17 October 2026.
Cybercriminals are hijacking European WhatsApp accounts through a stealthy scam that tricks users into approving device pairing access under the guise of voting for a young ballerina.
The Mechanics of Ghost Pairing Exploits
The scam begins with a deceptive social engineering lure distributed through direct messages [1][2]. In the Netherlands, targets receive a message from an acquaintance asking them to cast an online vote for a young ballerina named Eliska, who is purportedly competing for free dance lessons [1]. Victims who click the provided link are directed to a lookalike website designed to mimic a legitimate ballet school competition [1][2]. To complete the bogus voting process, the site prompts users to verify their identity by entering their mobile phone number on a fake portal [1].
Exploiting Authentication Workflows
Behind the scenes, entering a phone number on the phishing site initiates WhatsApp’s official device-linking procedure [1][2]. Cybercriminals favor using phone numbers and numeric pairing codes or fraudulent QR codes over traditional password theft to execute these takeovers [2][3][4]. Once the victim inputs the pairing code displayed during the verification attempt, the threat actor’s hardware links to the account as an authorized secondary device [1][2][3]. The primary user maintains normal app functionality and remains unaware that an adversary is actively monitoring communications [2][3][4].
Tracking Threat Vectors with Honeypot Innovation
To map and counteract this campaign, cybersecurity research firm Gen deployed instrumented WhatsApp honeypots—an innovative threat detection mechanism designed to simulate legitimate endpoints and record attacker interactions in real time [2]. Michal Salat, Director of Threat Intelligence at Gen, presented detailed findings on the campaign at the VB2026 conference on 15 October 2026 [2]. The honeypot technology provided data showing that the GhostPairing infrastructure originally originated in Czechia before expanding across Europe through localized pages, reusable templates, and lookalike web domains [2].
Infrastructure and Security Recommendations
As Michal Salat observed, “the weakness is not the protocol. It is the moment a trusted interface asks the user to approve the wrong thing” [2]. Because the attacker becomes a validated secondary endpoint, standard end-to-end encryption continues to function normally while serving data directly to the adversary [3]. Security investigations reveal that the underlying attack network spans over 200 domains equipped with anti-analysis mechanisms and session-handling tools to maintain persistent access [2][3]. To mitigate risks, security experts urge users to regularly inspect their WhatsApp ‘Linked Devices’ menu, terminate unauthorized sessions, and enable two-step verification [1][4][5].