---
title: "A WhatsApp and Gmail phishing campaign targeted high-profile people across the Middle East"
description: "Through a link sent on WhatsApp, attackers stole passwords and 2FA codes from a Lebanese minister, journalists and others. Here's how to protect yourself."
url: https://kurddevelopers.com/en/news/whatsapp-gmail-phishing-middle-east
language: en # English
type: news
published: 2026-01-16T17:15:00.000Z
updated: 2026-11-01T22:16:58.000Z
author: "Osamah Ismail"
author_url: https://kurddevelopers.com/en/author/1
section: "Security"
tags: ["WhatsApp","Gmail","phishing","2FA","security"]
sources: ["TechCrunch","Citizen Lab","DomainTools"]
image: https://kurddevelopers.com/uploads/2026/11/rukeqtvnjdy-c10b58df.png
translations:
  ku: https://kurddevelopers.com/news/whatsapp-gmail-phishing-middle-east
  ar: https://kurddevelopers.com/ar/news/whatsapp-gmail-phishing-middle-east
publisher: Kurd Developers
publisher_url: https://kurddevelopers.com/
---

# A WhatsApp and Gmail phishing campaign targeted high-profile people across the Middle East

> Through a link sent on WhatsApp, attackers stole passwords and 2FA codes from a Lebanese minister, journalists and others. Here's how to protect yourself.

![Image: WhatsApp](https://kurddevelopers.com/uploads/2026/11/rukeqtvnjdy-c10b58df.png)

Iranian-British activist **Nariman Gharib** shared screenshots of a phishing link he received on WhatsApp. TechCrunch investigated and found a targeted campaign against high-profile people in the Middle East.

## Who was targeted

- a senior Lebanese cabinet minister
- at least one journalist
- a national security academic
- the head of an Israeli drone maker

TechCrunch found an exposed file on the attackers' server with **over 850 records**, including usernames, passwords and **2FA codes**. Known victims number **fewer than 50**.

## How it worked

- A link was sent over WhatsApp
- A fake Gmail page asked for passwords and 2FA codes
- A **fake WhatsApp QR code** linked the victim's account to the attacker's device
- It also requested location, camera and microphone access

## Who is behind it

Unclear. A **Citizen Lab** researcher said it had the hallmarks of an **IRGC**-linked campaign; another expert said the infrastructure looks financially motivated. The site is now down.

## How to protect yourself

- Never scan a QR code sent by someone you don't know
- In WhatsApp, check **Settings → Linked devices** and remove anything unfamiliar
- Use a **passkey** or an authenticator app instead of SMS codes

**Sources:** TechCrunch, Citizen Lab, DomainTools

---

Published by [Kurd Developers](https://kurddevelopers.com/) on 2026-01-16. Cite as: “A WhatsApp and Gmail phishing campaign targeted high-profile people across the Middle East”, Kurd Developers, https://kurddevelopers.com/en/news/whatsapp-gmail-phishing-middle-east