A WhatsApp and Gmail phishing campaign targeted high-profile people across the Middle East
Through a link sent on WhatsApp, attackers stole passwords and 2FA codes from a Lebanese minister, journalists and others. Here's how to protect yourself.
Iranian-British activist Nariman Gharib shared screenshots of a phishing link he received on WhatsApp. TechCrunch investigated and found a targeted campaign against high-profile people in the Middle East.
Who was targeted
- a senior Lebanese cabinet minister
- at least one journalist
- a national security academic
- the head of an Israeli drone maker
TechCrunch found an exposed file on the attackers' server with over 850 records, including usernames, passwords and 2FA codes. Known victims number fewer than 50.
How it worked
- A link was sent over WhatsApp
- A fake Gmail page asked for passwords and 2FA codes
- A fake WhatsApp QR code linked the victim's account to the attacker's device
- It also requested location, camera and microphone access
Who is behind it
Unclear. A Citizen Lab researcher said it had the hallmarks of an IRGC-linked campaign; another expert said the infrastructure looks financially motivated. The site is now down.
How to protect yourself
- Never scan a QR code sent by someone you don't know
- In WhatsApp, check Settings → Linked devices and remove anything unfamiliar
- Use a passkey or an authenticator app instead of SMS codes
Founder and editor-in-chief of Kurd Developers. Phone and tech news on YouTube, Instagram and TikTok.
More stories
One text can break your phone: Android's 'SMS of Death' explained
A flaw in Android 12 and later lets a specially crafted SMS drop calls and even make a phone unusable. The fix is in October's security patch.
GTA VI lands November 19: prices, editions and what to know
Rockstar has locked the date: Thursday, November 19 on PS5 and Xbox Series X|S. Standard costs $79.99 and Ultimate $99.99.
Apple's first touchscreen MacBook Pro brings OLED and Dynamic Island
The new PROLED XDR display responds to touch, the notch is gone and Dynamic Island takes its place. Prices start at $2,899.
The $1,999 iPhone Duo Has a Black-Bar Problem, and Fixing It Is Harder Than It Looks
Apple's first foldable is a hardware flex. But unfold it and many of your apps shrink into a phone-shaped window floating in black. Here's why the app world wasn't ready, and why developers can't just hit "stretch".