1/ Over the past few days, I've been helping Arab activists who had their #WhatsApp account taken over. The attacker sends a generic message from "WhatsApp Business" to the target's phone, then follows up immediately through WhatsApp (as someone they know) and asks for the code

2/ The target receives the "apology&request" message from someone they know - that someone being the previous target of the attacker, and already had their account taken over. Once the attacker takes over a WhatsApp account, they go down the list of contacts, domino-effect

3/ What the attacker does here, is that they trick their target into handing them the WhatsApp confirmation code which, once entered into the attacker's phone, allows them to finalize the registration of the target's account. A classic social engineer attack.

4/ A good way to prevent this from happening is to turn on 2 Factor Authentication in the Settings of WhatsApp. If you haven't done so already, go to Settings -> Account -> Two-Step Verification.

5/ That way, even if an attacker tries to log into your WhatsApp by using your phone number, they will be prompted for the 2FA code or a verification to your email address.

6/ Another tip: when you receive a msg that feels off from someone you know, or maybe that you haven't spoken to in a while, and asking you to send them a code, verify that they are indeed the ones requesting it using a different method (call them on another app, email them, etc)

7/ The attack targeted dozens of Arab activists, many of them Syrian activists and organizers. Once one account is compromised, it becomes easy to gain the trust and trick other connections into falling for this.

8/ For each account, the attacker then starts the process of converting them to 'Whatsapp Business Accounts'. This triggers a text message from Whatsapp to the target's phone number. Then comes the "apology&request" through WhatsApp. And the process repeats itself.

9/ Stay safe out there folks. If you have more info about this, please feel free to share / reach out. And if you need help, same. DMs open.