The WhatsApp voting scam looks like the most harmless request you will get all week: a friend asks you to vote for a child called Mia. One tap later, a criminal can be reading your chats.
A WhatsApp message asking you to vote for a young girl who needs financial support for her studies is circulating in community groups. It looks innocent. It may come from someone you know. But behind the appeal could be a sophisticated account-takeover operation that turns your own WhatsApp account into a weapon against your friends and family.
Imagine receiving a WhatsApp message from a friend.
They ask you to vote for a young girl called Mia. She needs support to win financial assistance for her studies. The request is simple: click the link, cast your vote and help a child with her future.
It sounds harmless.
You recognise the sender’s number. Perhaps you have known the person for years. You might even have exchanged messages with them earlier that day.
You click the link.
A website opens, showing a photograph of a child and what appears to be a legitimate voting competition. You are asked to enter your mobile number or complete a WhatsApp verification process.
You follow the instructions.
You have not entered your banking details. You have not downloaded an application. You have not given anyone your password.
But you may just have authorised a criminal’s device to connect to your WhatsApp account.
And the most disturbing part?
You may continue using WhatsApp normally, completely unaware that someone else is reading your conversations and communicating with your contacts in your name.
This is a form of WhatsApp account takeover known as device-linking phishing. It exploits a legitimate WhatsApp security feature to deceive users into granting criminals access to their accounts.
It is not a theoretical threat. Cybersecurity researchers and law-enforcement agencies have documented this attack internationally.
In October 2026, Switzerland’s National Cyber Security Centre reported more than 50 cases of this type of WhatsApp account compromise during that month alone.
A South African community warning circulating on WhatsApp describes a particularly concerning variation: a young girl called Mia supposedly seeking financial support for her education.
Let’s examine how the operation works, why it is effective and what happens after criminals gain access.
1. What is the “Vote for Mia” WhatsApp voting scam?
The “Vote for Mia” message is an example of a fake voting phishing campaign designed to compromise WhatsApp accounts.
The criminals use an emotional appeal to persuade people to visit a fraudulent competition website. The website then guides the victim through a process that appears to be voting verification.
In reality, the process is designed to authorise an additional device on the victim’s WhatsApp account.
The scam combines several techniques:
- Social engineering.
- Phishing websites.
- Identity impersonation.
- Abuse of legitimate device-linking functionality.
- Account takeover.
- Secondary fraud using compromised accounts.
The subject of the voting request can change.
Researchers have documented variations involving:
- Children entering dance competitions.
- Young gymnasts and athletes.
- Ballet performances.
- School competitions.
- Charity initiatives.
- Other fictional or misleading voting campaigns.
The story is interchangeable. The account-compromise mechanism is what matters.
Why Mia?
The particular message circulating in the South African community describes a young girl called Mia who supposedly needs votes to win financial support for her studies.
This is a carefully selected emotional narrative.
It appeals to generosity, sympathy and the desire to help a young person obtain an education.
It does not initially ask for money. It does not ask for banking information. It asks for a vote.
That is precisely why people may lower their guard.
The name Mia should not be treated as proof of a particular criminal identity or organisation. The campaign’s actual operators and infrastructure have not been established from the circulating WhatsApp warning. The name has been used before: in Switzerland, a fake “Zurich Dance Academy” vote also asked people to vote for “Mia”.
2. This is not simply a malicious-link scam
One of the most important aspects of this operation is the technology being exploited.
WhatsApp allows users to connect additional devices to their accounts.
This is the legitimate Linked Devices functionality.
For example, you can connect:
- WhatsApp Web on your computer.
- WhatsApp Desktop.
- Another supported device.
This is convenient because you can communicate without having to use your primary phone for every message.
Normally, you authorise the additional device yourself.
Criminals have found a way to manipulate that process.
Instead of breaking into WhatsApp, stealing your password or taking over your SIM card, they persuade you to authorise their device.
You are effectively giving them permission without understanding what you are approving.
This is known as device-linking phishing.
The connection to GhostPairing
There is an important technical relationship between this voting scam and another documented campaign known as GhostPairing.
Gen Digital published a technical investigation into GhostPairing in December 2025.
That campaign used messages such as “Hi, check this photo” and fraudulent Facebook-style viewing pages.
Victims were persuaded to complete WhatsApp’s legitimate device-pairing process, unknowingly connecting an attacker’s browser to their accounts.
The fake-voting campaign documented by Kaspersky in September and October 2025 uses a similar underlying technique but a different lure.
Both exploit WhatsApp device linking.
It is therefore more accurate to classify the Mia campaign as a fake-voting WhatsApp account-takeover scam using device-linking phishing, rather than automatically assuming that it is the identical GhostPairing operation.
3. How the scam works: the complete attack sequence
Understanding the actual sequence is important because the victim may not realise when the compromise happens.
Stage 1: The criminal prepares the bait
The criminals create a fraudulent website that resembles an online competition.
It may include:
- A photograph of a child.
- A competition description.
- Voting buttons.
- Vote counters.
- Claims about sponsorship.
- An apparent deadline.
- A request to verify the voter through WhatsApp.
The website is designed to create the impression of legitimacy.
The voting page is not necessarily the actual objective. It is the first stage of the attack.
Stage 2: The message arrives from a trusted contact
The victim receives a WhatsApp message asking for assistance.
It might read:
“Please vote for Mia. She is trying to win financial support for her studies. It would mean so much to her.”
The message may come from a genuine WhatsApp account belonging to someone the victim knows.
This is particularly important.
The criminal may already have compromised that person’s account and is now using it to approach their contacts.
Alternatively, the sender may be an impersonator using a copied profile photograph and display name.
The distinction matters, but the effect is similar: the recipient is more likely to trust a message that appears to come from a familiar person.
Stage 3: The victim opens the voting website
The link directs the victim to a fraudulent website.
The website may look professional and contain enough information to make the competition seem genuine.
The victim is encouraged to click a voting or authorisation button.
They are then asked to enter their WhatsApp-associated mobile number.
This is where the real operation begins.
Stage 4: The criminal initiates a WhatsApp device-linking request
The attacker uses the telephone number supplied by the victim to initiate a WhatsApp device-linking process.
WhatsApp generates a pairing code for the new device.
The fraudulent website can display that code to the victim and instruct them to enter it into WhatsApp.
The victim may be told that this is necessary to verify their identity or validate their vote.
But the code is not authorising a vote.
It is authorising another device to connect to their WhatsApp account.
The victim is completing a legitimate WhatsApp security procedure under false pretences.
Understanding the different codes
It is important not to confuse the different WhatsApp verification processes.
Device-linking code: Used to authorise an additional device. In the documented fake-voting technique, this is the code the victim is manipulated into entering.
Registration verification code: Usually a six-digit code delivered through SMS or a telephone call when registering a WhatsApp number on a phone.
QR-code pairing: Another legitimate method of linking a device. A victim can be tricked into scanning a QR code that authorises an attacker’s device.
These methods are related but not interchangeable.
The exact process depends on the campaign being used.
Never enter a WhatsApp code into an unfamiliar website or approve a device-linking request simply because a website tells you that it is necessary to vote.
Stage 5: The criminal gains access
Once the pairing process succeeds, the criminal’s device becomes an authorised linked device.
This is the critical breach.
The attacker can potentially access synchronised conversations, receive new messages and send messages using the victim’s WhatsApp identity.
Depending on the implementation and synchronisation state, accessible information may include:
- Contacts and group memberships.
- Conversations.
- Shared photographs and documents.
- Personal discussions.
- Business communications.
- Financial conversations.
The exact extent of historical message and media access depends on the technical circumstances. It should not be assumed that every file ever stored on the victim’s phone automatically becomes available.
The attacker may also be able to delete or manipulate messages within the accessible messaging environment.
Crucially, the victim’s primary phone does not necessarily log out.
They may continue using WhatsApp normally.
This makes device-linking attacks particularly difficult to detect.
Stage 6: The compromised account becomes the next distribution channel
The criminal now has access to a trusted identity.
They can send the same voting invitation to the victim’s contacts and community groups.
The next recipients see a familiar telephone number and may assume that the request is genuine.
Some click.
Some authorise the criminal’s device.
The process repeats.
One compromised account can therefore introduce multiple additional victims into the operation.
This is how a phishing campaign can spread through existing social relationships rather than relying entirely on unsolicited messages.
4. Why criminals want access to your WhatsApp account
The objective is not necessarily to steal your WhatsApp account permanently.
In some cases, continued access through an additional linked device is more useful.
It allows the criminal to operate while the legitimate owner remains active.
Consider what a criminal can gain from access to an ordinary person’s WhatsApp account.
A. Your identity
Your WhatsApp account contains more than your telephone number.
It provides access to an established identity and a network of relationships.
The criminal may be able to communicate with people who recognise your name, profile photograph and number.
They can exploit the trust you have built over years.
B. Your conversations
Messages may reveal information about:
- Family members.
- Friends.
- Business relationships.
- Financial difficulties.
- Travel arrangements.
- Personal circumstances.
- Upcoming purchases.
- Payment discussions.
This information can help criminals create convincing, personalised messages.
A generic request for money is one thing.
A request that refers to a real family event, an existing financial arrangement or a known personal problem is considerably more convincing.
C. Your groups
Community groups are particularly valuable distribution networks.
A compromised account may belong to:
- A school parent group.
- A retirement community.
- A church group.
- A neighbourhood watch.
- A business network.
- A sports club.
- A local residents’ association.
One compromised account can potentially expose the group to further fraudulent messages.
The criminal inherits the credibility associated with the account.
D. Your photographs and shared information
Accessible shared media may reveal personal details that can be used in further impersonation or fraud.
Photographs and documents can also expose information that victims would never knowingly give to a stranger.
The consequences therefore extend beyond the WhatsApp account itself.
5. The second stage: financial fraud and impersonation
Once criminals have access to a trusted account, they have an opportunity to exploit its relationships.
This is where the financial consequences can begin.
The emergency money request
A criminal sends a message to a friend or family member.
“I am having a problem. Could you please help me with a payment?”
Other variations include:
- I need money urgently.
- My banking application is not working.
- Can you pay this account for me?
- I will refund you later.
- I am stranded and need assistance.
The recipient believes they are communicating with someone they know.
They may not think to telephone the person because the conversation appears to be taking place in the familiar WhatsApp account.
Business payment diversion
A compromised account belonging to a business owner or employee could create opportunities for payment-related impersonation.
For example, criminals might exploit conversations about outstanding invoices, suppliers or payments.
However, access to WhatsApp does not automatically provide access to the victim’s bank account or business systems.
A separate fraud or authorisation step would be required.
Family impersonation
Family relationships create another opportunity.
A criminal can use the victim’s identity to approach relatives, particularly where there are existing discussions about money, travel or personal emergencies.
The recipient may transfer money before verifying the request.
The important point is that the criminal does not have to invent an entirely new identity.
They are borrowing an existing one.
6. The psychology: why intelligent people fall for this scam
This is not simply a matter of people being careless.
The attack is deliberately structured to influence human decision-making.
It combines several psychological mechanisms.
1. Prosocial manipulation
People generally want to help others.
A child seeking educational assistance creates a particularly strong emotional appeal.
The victim is encouraged to think about the young person’s future rather than the security implications of the website.
2. Trust inheritance
When a message arrives from a familiar contact, the recipient may transfer their existing trust in that person to the message itself.
The assumption becomes:
“I know this person. They would not send me something dangerous.”
But the person may no longer control their account.
The criminal is exploiting an existing relationship.
3. Low perceived risk
Voting appears to be a simple, harmless activity.
It does not involve a financial transaction.
It does not appear to require sensitive information.
The victim may therefore spend very little time evaluating the request.
4. Procedural deception
This is arguably the most sophisticated part of the scam.
The criminal does not simply ask for a password.
They disguise an account-security procedure as part of an ordinary voting process.
The victim believes they are verifying a vote when they are actually authorising an additional device.
The procedure itself is legitimate. The explanation given by the criminal is false.
5. Urgency and social pressure
A competition deadline or the suggestion that a child needs support can create pressure to act quickly.
People may feel that delaying their vote means losing an opportunity to help.
This reduces the likelihood that they will stop and independently verify the request.
6. Familiarity with technology
WhatsApp is used every day.
People are accustomed to receiving verification messages and authorising new devices.
That familiarity can be exploited.
The victim may recognise the process without understanding what the authorisation actually permits.
The lesson is important:
A person can understand technology, use WhatsApp every day and still be manipulated into authorising a criminal’s device.
7. The criminal ecosystem: how one account can become many victims
The attack has the characteristics of a repeatable criminal operation.
It does not require the attacker to individually persuade every victim from scratch.
The compromised account supplies a ready-made network.
The process can be represented as follows:
Initial compromised account
A criminal gains access through a fake voting invitation.
↓
Trusted distribution
The criminal sends the invitation to existing contacts and groups.
↓
Further account compromises
Some recipients complete the fraudulent pairing process.
↓
Expanded access
The criminal gains additional identities and communication networks.
↓
Exploitation
The accounts can be used for further phishing, impersonation and financial fraud.
This creates a chain reaction.
The technical infrastructure
Investigations into related campaigns have identified:
- Fraudulent competition websites.
- Lookalike domains.
- Fake social-media viewing pages.
- Redirects to WhatsApp-related authorisation processes.
- Reusable phishing templates.
- Infrastructure designed to imitate legitimate services.
Gen Digital’s GhostPairing investigation identified clusters of fraudulent domains, including websites imitating Facebook-style photo and post viewers.
Kaspersky independently documented fake voting pages and the use of WhatsApp’s device-linking functionality.
These findings demonstrate that the underlying techniques can be reused and adapted.
However, they do not establish that every fake voting campaign is operated by the same criminal group.
It is also important not to assume that every campaign involves separate specialists, brokers or a criminal marketplace. The available evidence establishes reusable infrastructure and coordinated attack techniques, not necessarily the complete organisational structure behind each incident.
8. Is this the same as a SIM-swap scam?
No.
This distinction is particularly important in South Africa, where SIM-swap fraud is another recognised threat.
| Device-linking phishing | SIM-swap fraud |
|---|---|
| Victim authorises an additional device unknowingly. | Criminal obtains control of the victim’s mobile number through a SIM replacement or related carrier compromise. |
| Victim may continue using WhatsApp normally. | Victim may suddenly lose mobile network service. |
| Does not necessarily require access to the SIM card. | Involves the mobile number and network service. |
| Exploits WhatsApp’s legitimate device-linking process. | Exploits weaknesses in mobile-network identity verification or account administration. |
| Unknown linked devices may be visible in WhatsApp settings. | The victim may discover that calls and SMS messages no longer reach their phone. |
Both can result in WhatsApp account compromise.
But they are different attack methods and require different recovery responses.
A person should not assume that a WhatsApp compromise automatically means their SIM card has been cloned or swapped.
9. The South African threat landscape
This scam is particularly relevant to South African WhatsApp users.
WhatsApp is deeply embedded in everyday communication.
It is used for:
- Family communication.
- Community groups.
- School announcements.
- Business transactions.
- Local fundraising.
- Neighbourhood communication.
- Informal commerce.
- Service-provider relationships.
These networks provide criminals with opportunities to exploit established trust.
The South African warning uses local +27 telephone numbers and was shared in a community WhatsApp group.
That establishes local circulation of the warning, not the geographical origin of the criminals.
There is also relevant South African reporting.
On 17 October 2026, BusinessTech reported warnings about WhatsApp account takeovers and criminals approaching victims’ contacts with requests for money. The report discussed SIM-swap and social-engineering methods as part of the broader threat landscape.
SAPS and SABRIC have also issued general warnings about phishing, impersonation and social engineering.
The distinction is important: these sources establish the broader South African threat, but they do not independently confirm the exact Mia campaign’s operators or local victim numbers.
Why community groups are attractive targets
A community group is more than a collection of telephone numbers.
It represents an existing network of relationships.
People may recognise one another’s names, know their families and have previously helped each other.
A criminal who gains access to one account can exploit this social structure.
A message requesting assistance for a child, an elderly person or a community member may receive a very different response from a message sent by an unknown number.
This is why community awareness matters.
One compromised account can expose an entire network to additional attempts.
10. International warnings: this is not an isolated incident
The documented progression of these campaigns demonstrates that the technique has persisted and evolved.
15 September 2025 – Kaspersky
Kaspersky publicly documented a WhatsApp account-hijacking campaign using fake online voting competitions.
2 October 2025 – Kaspersky
A further technical explanation described how criminals initiate a WhatsApp Web linking process and trick victims into entering the generated code.
December 2025 – Gen Digital
Gen Digital published its investigation into GhostPairing, describing how criminals use fake content-viewing pages to trick people into pairing an attacker’s device.
19 December 2025 – CERT-In, India
India’s Computer Emergency Response Team issued a high-severity advisory about WhatsApp account takeover through device-linking abuse.
10 February 2026 – Singapore Police Force
Singapore Police issued a specific warning about fake child dance-competition voting messages.
The advisory explained how victims were asked to enter a mobile number and provide an OTP or scan a QR code, unknowingly authorising the criminal’s device.
26 May 2026 – Switzerland
The Swiss National Cyber Security Centre reported increasing WhatsApp account hijackings involving fake child-competition voting requests.
3 August 2026 – Malwarebytes
Malwarebytes documented further variations involving ballet performances, dog competitions and school events.
15 October 2026 – Virus Bulletin
A technical presentation on GhostPairing described the attack from the initial trusted message through to device takeover and subsequent exploitation.
27 October 2026 – Switzerland
The Swiss National Cyber Security Centre reported more than 50 cases of compromised WhatsApp accounts during October alone, many involving successful attacks.
1 November 2026 – Ireland
Irish media reported a warning from An Garda Síochána concerning a WhatsApp message asking people to vote for a child named Mia.
The similarity to the South African message is particularly noteworthy.
However, the Irish report describes a competition, while the South African warning describes financial support for studies. The similarity in the name and voting appeal does not establish that both campaigns use identical infrastructure or originate from the same criminals.
The international evidence nevertheless confirms that fake voting requests are an established and recurring method of WhatsApp account compromise.
11. What if you have already clicked the link?
The first thing to understand is that clicking a link alone does not automatically mean your WhatsApp account has been compromised.
The important question is what happened afterwards.
Scenario A: You opened the website but did nothing else
If you simply opened the website and did not enter information, approve a device or follow the pairing instructions, the specific device-linking attack may not have succeeded.
Close the website.
Do not continue with the voting process.
Check your WhatsApp Linked Devices list.
Scenario B: You entered your telephone number
Entering your number alone does not necessarily mean the attacker has gained access.
However, it may have allowed the attacker to initiate a device-linking request.
Do not enter any further codes or approve unexpected requests.
Check your Linked Devices immediately.
Scenario C: You entered a device-pairing code
This is the critical situation.
You may have authorised an additional device belonging to the criminal.
Immediately:
- Open WhatsApp.
- Go to Settings.
- Select Linked Devices.
- Review all connected devices.
- Log out of any device you do not recognise.
- Enable two-step verification if it is not already active.
- Inform your contacts through another communication channel.
Do not assume that continuing to use WhatsApp means your account is safe.
Scenario D: You scanned a QR code
If the QR code authorised an unfamiliar device, the criminal may have gained access.
Follow the same Linked Devices procedure immediately.
Scenario E: You supplied the six-digit registration code
This is a different and potentially more serious situation.
The criminal may have registered your WhatsApp number on another phone, displacing your own registration.
Open the official WhatsApp application and register your number again using the six-digit code sent to your phone.
According to WhatsApp’s official recovery instructions, successfully re-registering the number automatically logs out other devices using the account.
If an unknown two-step verification PIN has been enabled, WhatsApp may require a seven-day waiting period before you can regain access without that PIN.
12. What if your account has already been compromised?
A compromised account needs to be dealt with systematically.
Step 1: Remove unauthorised linked devices
If you can still access WhatsApp, inspect Linked Devices and remove anything unfamiliar.
Step 2: Re-register if you have lost access
If the criminal has displaced your registration, use the official WhatsApp registration process to regain control.
Do not confuse removing a linked device with recovering an account that has been registered on another phone.
They are different situations.
Step 3: Notify your contacts
Use SMS, telephone calls or another communication channel.
Explain that your WhatsApp account may have been compromised.
Tell people not to follow recent links or act on financial requests received from your account.
Step 4: Check financial exposure
If conversations involved banking information, payment instructions or financial details, assess what information may have been exposed.
If fraudulent payments have been made or banking credentials disclosed, contact the relevant bank immediately using its official contact channels.
Step 5: Preserve evidence
Keep:
- The original message.
- The suspicious website address.
- Screenshots of the voting page.
- Relevant WhatsApp notifications.
- Unknown linked-device information.
- Payment requests.
- Transaction details, if applicable.
Do not delete evidence before recording the relevant details.
Step 6: Report the incident
Report the fraudulent message to WhatsApp.
In South Africa, suspected financial fraud can be reported to the relevant bank and SAPS. Preserve the case reference and transaction evidence where applicable.
13. How to protect your WhatsApp account
There are several practical measures everyone should adopt.
Check Linked Devices regularly
Open WhatsApp and navigate to:
Settings → Linked Devices
Examine every connected device.
If you see an unfamiliar browser, computer or device, log it out.
Remember that an attacker may use a linked device while you continue using WhatsApp on your own phone.
Enable two-step verification
Navigate to:
Settings → Account → Two-step verification
Enable the feature and create a PIN.
Add an email address for recovery if prompted.
Two-step verification provides additional protection against unauthorised registration of your number.
However, it is not a substitute for checking linked devices. It does not automatically remove an attacker who has already been authorised as a linked device.
Never share WhatsApp verification codes
Do not provide a registration code or device-pairing code to anyone.
Not a friend.
Not a family member.
Not someone claiming to be from WhatsApp.
Not a voting website.
Never scan unfamiliar pairing QR codes
A QR code is not automatically harmless.
It can authorise a connection to another device.
Only link devices when you have initiated the process yourself and understand which device is being connected.
Verify unusual requests independently
If a friend asks you to vote for someone, call them or contact them through another trusted channel.
Do not simply reply to the same WhatsApp conversation.
If their account has been compromised, the criminal may be reading and responding to your messages.
Treat voting websites with caution
A genuine competition should not need access to your WhatsApp account to count your vote.
A request to connect a WhatsApp device as part of a voting process is a major warning sign.
14. The uncomfortable truth: your account can become a weapon against your own family
The most concerning aspect of this scam is not necessarily the initial account compromise.
It is what happens afterwards.
Your WhatsApp account contains your relationships, your conversations and the trust other people place in you.
When criminals gain access, they can exploit all three.
They may use your identity to approach your family.
They may use your conversations to make financial requests more convincing.
They may use your community groups to distribute the same fraudulent invitation.
The people receiving these messages may have no reason to suspect anything.
They see your name.
They see your photograph.
They see your familiar telephone number.
And they trust you.
This is how a single account compromise can become a multi-victim operation.
It also explains why the consequences can continue long after the original voting message has disappeared.
15. The most important warning
There is a difference between protecting your password and protecting your identity.
Many people understand that they should never share their banking password, disclose an OTP or give their PIN to a stranger.
But this scam exploits something less obvious.
It persuades the victim to authorise a legitimate security function for an illegitimate purpose.
The criminal does not necessarily need to break into the account.
They persuade the account owner to open the door.
And once inside, they may use that trusted identity to reach everyone connected to it.
Never authorise a WhatsApp device, enter a pairing code or scan a QR code simply to vote for someone. No genuine competition needs access to your WhatsApp account to count your vote.
If you receive a message asking you to vote for Mia, or any other child in a competition, stop and verify it independently.
A simple vote should never cost you your digital identity.
Related reading: WhatsApp “Hi Mum, new number” scam · Social media scams · Hacked account recovery scams · What to do immediately after being scammed
Check before you pay
About to pay a seller or business you don’t know? Start with a Free Quick Check of the advert link. It screens for common warning signs and shows where each result came from.
If you need the seller researched, a Quick Report or Comprehensive Report brings together source-linked Search Results on the seller and the offer. Neither gives a verdict: you check the sources and decide for yourself.
Research sources and further reading
The following sources provide the technical evidence, law-enforcement warnings and official recovery guidance behind this investigation.
International law enforcement and government advisories
- Singapore Police Force – 10 February 2026 Police advisory involving the compromise of WhatsApp accounts.https://www.police.gov.sg/Media-Hub/News/2026/02/20260210_police_advisory_involving_the_compromise_of_whatsapp_accounts
- CERT-In, India – 19 December 2025 WhatsApp Account Takeover Campaign (GhostPairing), Advisory CIAD-2025-0055.https://www.cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2025-0055&pageid=PUBVLNOTES02
- Swiss National Cyber Security Centre – 27 October 2026 Scammers once again hijack WhatsApp accounts with fake requests to vote.https://www.bacs.admin.ch/en/26w43-en
- An Garda Síochána – Ireland Warning concerning the “Vote for Mia” WhatsApp campaign, reported 1 November 2026.See the reported warning: https://extra.ie/2026/11/01/news/whatsapp-scam-message
Cybersecurity research
- Kaspersky – 15 September 2025 Kaspersky warns of WhatsApp account hijacking scam involving fake voting.https://www.kaspersky.co.za/about/press-releases/kaspersky-warns-of-whatsapp-account-hijacking-scam-involving-fake-voting
- Kaspersky – 2 October 2025How to protect yourself from voting phishing scams and avoid losing your WhatsApp account.https://www.kaspersky.com/blog/whatsapp-phishing-vote/54515/
- Gen Digital – December 2025 GhostPairing Attacks: From Phone Number to Full Access in WhatsApp.https://www.gendigital.com/blog/insights/research/ghostpairing-whatsapp-attack
- Malwarebytes – 3 August 2026 WhatsApp account takeover scam asks you to vote for my friend.https://www.malwarebytes.com/blog/scams/2026/08/whatsapp-account-takeover-scam-asks-you-to-vote-for-my-friend
- Virus Bulletin – 15 October 2026 Ghosts in the chat: tracking GhostPairing from trusted message to linked-device takeover.https://virusbulletin.com/conference/vb2026/abstracts/tips-ghosts-chat-tracking-ghostpairing-trusted-message-linked-device-takeover/
South African context
- SAPS / SABRIC Guidance on phishing, vishing and smishing.https://www.saps.gov.za/alert/all_shing.php
- BusinessTech – 17 October 2026 Warning for people using WhatsApp in South Africa.https://businesstech.co.za/news/telecommunications/880136/
Official WhatsApp recovery guidance
- WhatsApp Help Centre How to recover a compromised account.https://faq.whatsapp.com/1131652977717250/
- WhatsApp Help Centre How to check linked devices and unlink a device you do not recognise.https://faq.whatsapp.com/1428782138011916/
AdUncovered – Scam Guides 2026: Check Before You Pay
Investigate suspicious online offers, messages and websites before trusting them.
