Óscar Collado received a message one morning on WhatsApp from his 20-year-old daughter, Vivianne.
Read more The average salary is no longer enough to buy a 75 square meter house in most of Europe
—Can you help me with a favor?
—Of course, daughter, that’s not even a question. Tell me
—Now I need to make a payment of €988, but I already used up today’s limit. Can you advance it to me by immediate transfer? I’ll pay you back tomorrow, I promise
After reading this last message, he calls his daughter. She doesn’t answer. He calls again.
—But pick up the phone. What is the money for?
—I’m with people and I don’t want to talk about money out loud
That answer didn’t make sense, Collado thought, but he got scared thinking that maybe his daughter was with someone who wouldn’t let her call. The girl tells him she needs the money to pay for something she bought cash on delivery. The father insists she call him. Then Vivianne makes a missed call to him via WhatsApp. “That’s when I really got worried that something might be happening to her,” Collado recalls. He calls the mother, from whom he is separated, alarmed. She tells him the girl stayed overnight at a friend’s house, and that she also received similar messages.
Vivianne wakes up late that Wednesday during vacation. She sees several missed calls from her parents and her boyfriend. All three have received messages from her asking for money. But those messages don’t appear on her phone when she checks the chats. Only the recipients see them. Her WhatsApp account has been hacked. Vivianne was a victim of a cyberattack that is spreading like wildfire these days in Spain. It happened last week, but since then cases have multiplied across the country. “We don’t have exact figures, but we could say that this fraud has a higher impact on the population than usual,” says Raquel Loma, cybersecurity technician at the National Cybersecurity Institute (Incibe).
The dangerous thing about this scam is that it’s no longer a stranger asking for money, but a family member or friend. From the WhatsApp account you may have been writing to for years. This attack has another particularity: unlike other cases, the victim does not have to click any link, scan QR codes, or download files. This is what is known in jargon as zero-click: the attacker accesses the victim’s account without the victim doing anything, so it catches them completely by surprise.
How do cybercriminals manage to enter other people’s WhatsApp accounts? The only mistake of those who suffer this scam is not having their phone updated. The attackers exploit a vulnerability in iOS, the operating system of iPhones, prior to version 16.7.12. Vivianne, for example, has an iPhone 12 that had not been updated for a long time because her phone’s memory was full of photos.
Saúl M., 48 years old, also has an old, unupdated iPhone. His WhatsApp was hacked this Tuesday. In the morning he received messages he didn’t understand from very close contacts. His mother asked what kind of help he needed. His girlfriend asked what it was about needing 850 euros for a phone. And another friend asked what kind of business he was offering. During his phone conversation with EL PAÍS, this university professor’s WhatsApp keeps sending those messages—even to this journalist, who is asked for 980 euros to buy a phone. But Saúl does not see those messages on his phone. Just in case, he warned all his contacts that he did not need money or help. In his eyes, the scam leaves no trace.
The trail leads to Italy
The first thing known about this cyberattack leads us to Italy. In May, several cases were detected in that country where WhatsApp accounts were used without authorization from iPhones with different versions of iOS 16. “The victims discovered that messages had been sent from their own accounts to contacts, especially recent ones, requesting money,” explains Loma from Incibe. What was striking was that no unknown devices appeared in the “Linked Devices” section of the victims’ WhatsApp accounts.
“Forensic investigation suggests as a possible explanation a chain exploitation of two vulnerabilities,” adds Loma. Both were resolved by iOS and WhatsApp. Those who have updated the operating system and the app have nothing to fear. “In the investigated cases, the attacker manages to interact with the device and subsequently with the WhatsApp account by exploiting vulnerabilities in the system and the app.” The criminal does not need to trick the victim into voluntarily giving the WhatsApp verification code, as had been seen in other attacks. They usually contact people the victim interacts with and often express themselves similarly. Hence its effectiveness and surprise effect.
How can it be that the victim does not see on their phone the messages the attacker is sending in their name? “When that happens, the attack has been carried out against WhatsApp Web, that is, through linked devices. The victim continues to see messages sent by their contacts, but not those sent in their name by the person who has impersonated the account. The attacker uses the ‘Delete for me’ option. Since the victim’s device and the attacker’s device are synchronized, it is deleted on the victim’s side,” says David Arroyo Guardeño, senior scientist of the Cybersecurity and Privacy Protection Research Group (GICP) of the CSIC.
What to do if you are a victim
If you fall for this fraud, the first thing is to warn your most important contacts. “It should be communicated, preferably by phone call, SMS, or email, that messages sent from WhatsApp may not be legitimate and ask contacts not to make any transfers,” says Lomas. If someone has sent money, they should request the bank to review or cancel the operation, indicating that it is a transfer related to fraud.
You should also log into your WhatsApp account, check linked devices (your phone and perhaps your computer or tablet should appear there), and close any session you don’t recognize. It is also recommended to uninstall and reinstall WhatsApp to start the account registration and linking process with a single device again. Once control of the account is recovered, it is advisable to activate two-step verification from WhatsApp settings. And, of course, keep iOS and the app updated.
Incibe also urges saving screenshots, sent messages, transfer data if applicable, and any other information related to the fraud. And to file a complaint with the police if there has been financial harm.
That’s what Óscar Collado did the same day he found out his daughter’s account had been hacked. He filed a complaint and called Incibe, which told him how to restore the account. His daughter, Vivianne, has learned from this experience that it’s worth keeping the phone updated, even if it means having to delete a few photos.
