WhatsApp Account Hijacking Fraud: New Scam Exploiting iOS Vulnerabilities Spreading Rapidly

A new fraud detected in Spain allows criminals to hijack WhatsApp accounts and send money requests to the victim's contacts, claiming urgent situations like COD delivery payments. The scam exploits iOS vulnerabilities through zero-click attacks, meaning users don't need to click links or download files. First detected in Italy in May 2026, it has rapidly spread to Spain.

How the Scam Works

Criminals exploit iOS vulnerabilities (versions before 16.7.12) combined with WhatsApp application weaknesses. This "zero-click attack" means victims' accounts are compromised without any user action—no clicking links, scanning QR codes, or downloading files.

After gaining access, attackers send fraudulent messages using a linked device while using the "Delete for Me" feature. This prevents the attackers from seeing the messages they send, but recipients see them normally in conversation threads.

Why This Scam Is Particularly Dangerous

Requires no user action: Accounts are hijacked without victims doing anything
Hard to detect: Victims may not realize their account is compromised
High trust level: Fraudulent messages appear from known contacts in regular conversation threads, making them more believable than typical impersonation scams

Unlike previous scams using unknown numbers with excuses like "I've lost my phone, calling from a friend's device," messages now come from the victim's actual account within existing conversation threads.

Fraudulent Message Content

Attackers request money from the victim's contacts with urgent claims such as:

Payment for cash-on-delivery shipment completion
Emergency funds to replace lost or damaged smartphones
Other urgent financial assistance

If Your Account May Be Compromised

Take these steps immediately:

Alert important contacts: Call, text, or email key contacts warning them not to send money even if they receive suspicious messages
Check linked devices: Review WhatsApp settings for linked devices and terminate any unrecognized sessions
Reinstall the app: Uninstall and reinstall WhatsApp to restart registration
Enable two-step verification: Activate this feature in WhatsApp settings
Update systems: Update both iOS and WhatsApp to the latest versions
Save evidence: Collect and save screenshots, messages, transfer records, and all related information
File a police report: Report to Policía Nacional or Guardia Civil even if no money was lost
Contact INCIBE: Call their cybersecurity helpline at 017 or email incidencias@incibe-cert.es

If Your Contact Sent Money Due to Fraud

If someone received a fraudulent message and sent money:

File a police report immediately
Contact your bank right away and request measures to recover the funds
Document all evidence thoroughly and file a formal complaint

Banks may initially reject claims, so quick action and detailed documentation are critical.

Protection Tips

Keep everything updated: Maintain current versions of both OS and applications
Enable two-step verification: Activate in WhatsApp settings
Distrust urgent requests: Suspect money requests even from known contacts
Don't click links in messages: Avoid clicking any links in suspicious messages
Monitor personal information: Periodically check if your data has been compromised online

The best defense combines security measures with healthy skepticism. Always verify money requests by phone call or in-person conversation before sending funds, regardless of who the message appears to come from.