WhatsApp accounts targeted by voicemail and social engineering attacks

Cybercriminals are employing various tactics to hijack WhatsApp accounts and steal personal data, often using phone numbers as a starting point. One prevalent method involves social engineering, where attackers pose as trusted contacts or institutions to trick users into sharing SMS verification codes.

A more technical vulnerability involves exploiting voicemail systems. When an attacker attempts to register a victim's number on a new device, they can request the verification code via a phone call. If the victim does not answer, the code may be left on their voicemail. If the voicemail uses a default or weak PIN, attackers can access the message and complete the account takeover.

To mitigate these risks, experts recommend using two-step verification, setting strong SIM PINs, and being cautious of unsolicited links or messages. For those using certain providers like Movistar, disabling voicemail and call forwarding using specific codes (such as ##002#) is suggested as a way to close this security loophole.