Russian state-backed hackers are hacking WhatsApp accounts of government ministers and officials around the world in a new tactic. Recently, hackers have been stealing sensitive data including messages by sending fake invitations through e-mails and connecting users to a WhatsApp group.
According to a Microsoft blog post, the hackers posed as US government officials in fake e-mails. A QR code is provided in the e-mail. Scan it and offer to join a WhatsApp group. However, this is actually a hacking technique. The QR code connects the user to WhatsApp Web or another device. This allows hackers to access the victim's account and steal sensitive data including messages.
A group called 'Star Blizzard' is behind this hacking. According to UK's National Cyber Security Center (NCSC), this hacker group is associated with Russian intelligence agency FSB. Their purpose is to spread confusion in the politics of other countries including UK.
This hacking is not limited to ministers and government officials; Those involved in diplomacy, defense policy, international relations and aid to Ukraine have also been targeted.
In 2023, 'Star Blizzard' targeted UK parliamentarians, universities and journalists. The UK government then imposed sanctions on two members of this hacker group.
Microsoft has said that although the attacks on WhatsApp have decreased since last November, they may change their tactics and become active again. As part of this, hackers are now using QR codes to trap and steal information. This is known as 'quising' to cyber security experts.
Microsoft has given some advice to WhatsApp users in this regard—
– Verify suspicious e-mails first.
-If an e-mail looks suspicious, verify a previous sender or known e-mail address.
-Be careful before clicking on QR codes or links.
WhatsApp, owned by Meta, is an end-to-end encrypted app that keeps both sender and receiver messages secure. However, if the user allows a third party to access the account by clicking on the QR code or link, its security may be compromised.
A WhatsApp spokesperson said, 'If you want to connect your WhatsApp account to another device, just use the official WhatsApp platform. Do not use third party links or QR codes. Avoid clicking on links sent by anyone other than known and trusted people.'
