Your New Year's gift: a hacked WhatsApp account

NCCIA issues an advisory warning against suspicious messages, "zero-click" exploits

ISLAMABAD:

In the hope of getting New Year gifts, you can end up getting your WhatsApp hacked, the National Cyber Crime Investigation Agency (NCCIA) has warned in an advisory issued on Sunday.

The agency urged people to be cautious of New Year fraud. Messages containing “congratulatory links” or “fake gifts” are currently circulating. Users are advised not to click on any unknown links and never share their WhatsApp verification code with anyone, it said.

Experts warn that hackers often disguise spyware as gifts, and a single click can compromise your mobile device or WhatsApp account. This can put a user’s files and WhatsApp chats at risk, violating their privacy. The agency urged extreme caution and advised users to avoid clicking on any suspicious links.

WhatsApp is a widely used instant messaging platform that allows users to send text messages, voice notes, images, videos, documents, and make voice and video calls over the internet.

It leverages end-to-end encryption, ensuring that messages are only visible to the sender and recipient, making communications highly secure. The app can, however, be compromised through spyware, though not typically by simple hacking like guessing passwords.

Spyware attacks usually target the phone itself and can be installed in several ways. Clicking on malicious links sent via WhatsApp, SMS, or email can install spyware that reads messages, records calls, or captures keystrokes.

Advanced “zero-click” exploits can infect a phone without any interaction, sometimes through a missed call or message; these are rare and often target high-profile individuals like journalists or politicians.

Other risks include compromised backups on Google Drive or iCloud, physical access to the phone, and the use of unofficial WhatsApp versions, which are particularly vulnerable.

Once installed, spyware can read chats, listen to calls, access the camera and microphone, track location, and even capture keystrokes or screenshots.