In Morocco, there is an alarming increase in reports related to the hacking of WhatsApp accounts, a trend that poses significant risks to both individuals and businesses. Cybercriminals are exploiting the most vulnerable link in this scenario: users' trust in their friends and business partners. This manipulation, which includes identity theft and targeted financial scams, has become a prevalent issue, as confirmed by CybernityOne, a cybersecurity and IT systems protection firm.
According to CybernityOne, the hijacking of WhatsApp accounts is frequently employed to orchestrate sophisticated financial frauds. These scams affect both private individuals and corporate entities. The attackers utilize a variety of well-established techniques, with social engineering being at the forefront of their strategies. This method involves manipulating victims into unknowingly sharing their SMS verification code or approving a suspicious remote login. Additionally, the practice of SIM swapping and the fraudulent association of accounts with third-party devices are also on the rise.
Once the hacker secures control over the account, they exploit the trust and reputation associated with the number in order to solicit emergency money transfers from the victim's contacts. The close relationship and apparent legitimacy of the number significantly diminish the skepticism of the recipients, making them prime targets for fraud.
The Corporate Sector Under Threat
The issue escalates particularly within the economic fabric of Morocco. If a WhatsApp account belonging to a company executive or financial officer is compromised, it opens the door to highly elaborate scams, including CEO fraud. In such cases, the impostor demands an urgent and confidential bank transfer while masquerading as a decision-maker within the company. CybernityOne has pointed out that while a spoofed email may raise suspicion, a WhatsApp message from a 'genuine' number inspires immediate trust, allowing fraudsters to bypass traditional security protocols effectively.
This technique enables scammers to navigate around established security measures, as the messages appear within a familiar communication channel that has a history of authentic conversation. The implications for businesses are profound, as the fallout from such fraud can lead to significant financial losses and reputational damage.
Vulnerabilities of Small Businesses and Preventive Measures
CybernityOne has raised alarms regarding the vulnerability of small and medium-sized enterprises (SMEs) that operate through direct digital channels. Online merchants, restaurateurs, artisans, and service providers who rely on WhatsApp for managing customer relationships and payment follow-ups are particularly at risk. They stand to incur severe financial losses, coupled with irretrievable damage to their databases and business history.
This trend aligns with a global uptick in attacks targeting mobile devices, which now centralize critical functionalities such as receiving authentication codes (OTPs), managing professional messaging, and banking applications, thus making them prime targets for cybercriminals. To mitigate these risks, CybernityOne offers several essential recommendations based on best practices for digital hygiene. Users should never disclose verification codes to anyone, and it is imperative to enable two-step verification through a secure PIN. Regularly checking the list of connected devices within the app settings is also advised to detect any unauthorized access.
Moreover, experts advocate for stringent verification of transactions. Any request for a transfer or funds received via messaging should be confirmed through a direct voice call to a pre-registered number, independent of the channel used by the sender. Early detection of anomalies relies on analyzing the interlocutor's behavior; any sense of urgency or demand for confidentiality should be interpreted as key indicators of suspicion, warranting immediate cessation of communication and rigorous scrutiny of the request.
If identity theft occurs, experts recommend promptly initiating the account reset procedure, alerting personal and professional networks through alternative channels, and contacting the telecom operator if there is any suspicion of SIM line interception. Ultimately, while technology provides end-to-end encryption for discussions, it does not safeguard against direct account access compromise. Overall security hinges on human vigilance and the strict application of control procedures.
As reported by h24info.ma.
