WhatsApp phishing campaign targets users with fake dance contest scams

A coordinated phishing campaign is spreading across Europe, targeting WhatsApp users through a social engineering tactic known as ‘ghost pairing’. Scammers send messages from seemingly trusted contacts—often appearing to be friends or family—asking for a quick favor: voting for a young girl named ‘Eliska’ or ‘Sophie’ in a dance competition.

The messages contain malicious links that redirect victims to fraudulent websites mimicking a voting platform. After entering a phone number, users are prompted to enter a code into WhatsApp. This code is not for voting; instead, it is a device linking code that allows attackers to authorize a parallel session on the victim's account. Once access is gained, criminals can monitor chats, steal contact lists, and impersonate the victim to solicit money from their acquaintances.

Security experts and organizations, including Spain’s INCIBE and Bitdefender, have identified hundreds of fraudulent domains and URLs associated with this wave. To protect against this, users are advised to never click on unsolicited voting links, to check ‘Linked Devices’ in their WhatsApp settings to terminate unrecognized sessions, and to enable two-step verification.