The use of instant communication platforms increased considerably due to the pandemic isolation, which represented an ideal opportunity for cybercriminals to deploy ambitious hacking campaigns. One of the most recent incidents has been reported in Bogota, Colombia, where local government officials claim their WhatsApp accounts were hacked.
Apparently, these attacks are based on sending a code via SMS with which threat actors will try to steal your information. Through his Twitter account, Bogota Secretary of Government Luis Gómez reported that his account had been compromised, so he asked his contacts to ignore any messages sent from their phone number: “If they receive an SMS message asking for information, please don’t answer,” the official says.
The incident would also have affected some local media journalists, including news anchors Diana Calderón and Gabriel Meluk, who also asked users to ignore such messages.
These incidents have already been notified to the relevant authorities. At the moment it is ignored whether the cybercriminals compromised randomly chosen WhatsApp accounts, or whether it is a campaign targeted specifically against the affected users, although the authorities have not ruled out any possibility.
Cybersecurity experts describe this practice as a social engineering attack that involves sending a text message to the target user asking them to send a security code; if the user falls into the trap, threat actors will use this code to log in to WhatsApp on another device, accessing all the information that victims store on this platform.
It is important to note that this attack depends entirely on the confidence of the target user, so threat actors resort to techniques such as impersonating a WhatsApp operator or pretending to be one of the victim’s contacts, which certainly helps users to let their guard down.
These are more common attacks than you think, so you need to consider some recommendations to prevent the engagement of our IM accounts:
- Enable multi-factor authentication on WhatsApp to add an additional security layer
- Don’t share security codes with anyone
- Do not open links sent by unknown users
- Keep the app always up to date to its latest version
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
