started · updated
Polish officials' WhatsApp accounts hijacked in phishing scam
A wave of cyber‑attacks has compromised WhatsApp accounts of several high‑profile Polish figures. Victims include Deputy Minister of Justice Arkadiusz Myrcha, MP Mariusz Popielarz, water‑sector chief Mateusz Balcerowicz, former ski‑jumping star Adam Małysz and others. Attackers gain control by pairing a device with the victim’s account via a QR code or verification code, then use the hijacked account to send messages that appear to come from a trusted contact. The messages invite recipients to vote in a fake contest or scholarship competition and contain a link that, when clicked, completes the “verification” and gives the criminals full access to the account.
CERT Polska, the computer‑security team of the NASK research institute, issued an urgent warning. It advises anyone who receives such a message to immediately disconnect all unknown devices in WhatsApp’s settings, avoid clicking the link, and report the incident through the online form at incydent.cert.pl or the mObywatel app. The warning has been reiterated by government spokespeople and spread across social media, highlighting the risk of a cascade effect as compromised accounts forward the scam to all contacts.
Entities
Adam Małysz · Arkadiusz Myrcha · CERT Poland · CERT Polska · Karolina Gałecka · Mariusz Popielarz · Microsoft Store · Ministry of the Interior and Administration (Poland) · NASK · Polish government · WhatsApp · Wintoys (Bogdan_X)
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 11 SOURCES] The scam uses QR codes or verification codes to pair the attacker’s device with the victim’s WhatsApp account. www.polsatnews.pl · wiadomosci.gazeta.pl · www.moja-ostroleka.pl · natemat.pl · misyjne.pl · +5 more
- [● 11 SOURCES] Karolina Gałecka, spokesperson for the Ministry of Interior and Administration, posted the CERT warning on X. www.polsatnews.pl · wiadomosci.gazeta.pl · www.moja-ostroleka.pl · natemat.pl · misyjne.pl · +5 more
- [● 11 SOURCES] Vice‑minister of justice Arkadiusz Myrcha's WhatsApp account was compromised and used to spread the fraudulent link. wiadomosci.onet.pl · www.polsatnews.pl · wiadomosci.gazeta.pl · www.moja-ostroleka.pl · natemat.pl · +5 more
- [● 11 SOURCES] CERT Polska reported that criminals are hijacking WhatsApp accounts and sending messages about a fake contest asking recipients to vote. wiadomosci.onet.pl · www.polsatnews.pl · wiadomosci.gazeta.pl · www.moja-ostroleka.pl · natemat.pl · +5 more
- [● 11 SOURCES] CERT Poland advises victims to remove added devices from WhatsApp settings to block attackers. wiadomosci.onet.pl · www.polsatnews.pl · wiadomosci.gazeta.pl · www.moja-ostroleka.pl · natemat.pl · +5 more
- [● 11 SOURCES] After gaining access, attackers can send further messages to the victim’s contacts, propagating the scam. www.polsatnews.pl · wiadomosci.gazeta.pl · www.moja-ostroleka.pl · natemat.pl · misyjne.pl · +5 more
- [○ 1 SOURCE] Messages were also sent from MP Mariusz Popielarz's WhatsApp account. www.moja-ostroleka.pl
- [● 10 SOURCES] The fraudulent messages claim to be a voting for a scholarship or a podcast contest. wiadomosci.gazeta.pl · natemat.pl · misyjne.pl · tylkotorun.pl · biznes.interia.pl · +4 more
- [● 10 SOURCES] The scam messages have been sent from the WhatsApp accounts of MP Mariusz Popielarz and Deputy Minister Arkadiusz Myrcha. www.moja-ostroleka.pl · natemat.pl · misyjne.pl · tylkotorun.pl · biznes.interia.pl · +4 more
- [● 11 SOURCES] CERT Poland issued the warning on 2 August 2026. wiadomosci.gazeta.pl · www.moja-ostroleka.pl · natemat.pl · misyjne.pl · tylkotorun.pl · +5 more
- [● 11 SOURCES] The fraudulent link leads to a website that pretends to be a contest or scholarship and requires WhatsApp verification. wiadomosci.gazeta.pl · www.moja-ostroleka.pl · natemat.pl · misyjne.pl · tylkotorun.pl · +5 more