This campaign abuses WhatsApp's 'Linked devices' feature by sending phishing messages from compromised accounts to their contacts. The messages contain links that redirect through pages mimicking WhatsApp, often using the legitimate wa.me domain, to trick victims into authorizing a new linked session. Once authorized, attackers gain full access to the victim's WhatsApp account, including reading and sending messages and accessing contacts. The attack propagates by using compromised accounts to target their contacts, creating a chain of account takeovers. The campaign relies heavily on social engineering and trust within contact networks.

Successful exploitation results in full takeover of WhatsApp accounts, allowing attackers to read private messages, send messages impersonating the victim, and access the victim's contacts. This enables further propagation of the scam and potential additional fraud or social engineering attacks. The scam does not exploit a software vulnerability but abuses legitimate platform features combined with social engineering.

No official patch or fix is applicable as this is a social engineering campaign abusing legitimate WhatsApp features. Users should be educated to avoid clicking unsolicited links, especially those asking to authorize new linked sessions. Verification of such requests through direct communication with the contact is recommended. WhatsApp users should regularly review their linked devices and remove any unknown sessions. Monitoring official WhatsApp security advisories for updates is advised. Patch status is not applicable; this is a user behavior and awareness issue.