Organized cybercrime networks are stealing WhatsApp accounts across Lebanon and using them to trick contacts into sending money through transfer companies.
Thousands of Lebanese citizens have fallen victim to coordinated WhatsApp account thefts over the past year, with hackers impersonating account holders to extort money from their contacts through money transfer services. The networks operate in two stages: first stealing a WhatsApp account, then deceiving the victim's contacts into sending cash. The practice has spread across all social strata, including members of parliament, ministers and social workers whose position makes them trusted sources of financial requests.
Amer Tabbash, an information and communications technology consultant, told Nidaa Al Watan that lawmakers and government officials from across Lebanon have been targets of organized hacking operations. Social figures working in charitable assistance have been particularly vulnerable because their contacts are accustomed to sending them money, making those networks a prime target for hackers seeking to maximize returns from each stolen account.
The technique begins with a message sent through Messenger before the hacker takes control of WhatsApp itself. Users unfamiliar with the security features of these applications become easy targets. The hacking methods have evolved alongside the development of social media platforms, growing more sophisticated as Lebanese citizens increasingly conduct financial transactions through mobile applications.
One victim, Azza, works in social assistance and regularly requests money from her contacts as part of her job. When her account was stolen, hackers exploited her professional role to convince some of her contacts to send money through transfer companies. The embarrassment of her contacts falling for the scam compounded the damage to her reputation and trustworthiness.
The Ministry of Telecommunications told Nidaa Al Watan that it cannot take action to block any application without a court order. The ministry said account hacking does not fall under its authority because the applications operate outside Lebanon and their servers are located abroad. Responsibility for combating cybercrime falls instead to the security forces, particularly the Cybercrime Bureau and Information Branch.
However, cybersecurity experts and security officials emphasize that the first line of defense rests with users themselves. Lebanese citizens must protect their accounts the way a homeowner protects a house from thieves, according to the comparison drawn by security and technology professionals. Most account compromises occur because users fail to activate available security features or fall for basic social engineering tricks.
The weakest point in WhatsApp security comes when users do not activate fingerprint protection and two-factor authentication in the app's security settings. A WhatsApp account without these protections can be stolen through links containing malicious software or by tricking the user into sharing the one-time password code sent to their phone. Once a hacker gains control, they access the victim's entire contact network and begin targeting those contacts as well.
Hackers employ several common methods to compromise accounts. They send invitations to join groups named "WhatsApp Join Group" with malicious links that users fail to recognize because the web address does not contain official WhatsApp logos or indicators. Others send images and request users to download them, potentially embedding malicious code that spreads to the phone's other applications and data.
Some hackers send applications that claim to offer functionality but actually take control of WhatsApp and access other information stored on the device. Security officials and cybersecurity experts warn strongly against certain practices that make accounts particularly vulnerable, though the source material does not specify all such practices. The sophistication of hacking operations has grown as mobile payment services have become more prevalent among Lebanese users.
The Head of the Public Relations Division at the Internal Security Forces, Brigadier Joseph Moussallem, has helped launch an awareness campaign to educate the public about account security. However, the campaign has not yet stemmed the tide of thefts. Security forces continue to investigate hacking networks and work to arrest those involved in the coordinated theft operations.
The evolution from earlier forms of cybercrime shows how hacking techniques have adapted to new technologies. Before account hacking became widespread, theft occurred through stealing mobile phone recharge cards that functioned as electronic wallets. The techniques then shifted to blackmail involving stolen personal photographs, with hackers demanding money not to publish the images.
As Lebanese citizens increasingly rely on electronic payment systems and money transfer applications, organized criminals have moved to the current two-stage model: stealing a WhatsApp account and then using the victim's trusted status to deceive their contacts into sending money. The ease of this method stems from many users' unfamiliarity with how these applications work and what security features are available to them. Until users take responsibility for protecting their own accounts, the networks are likely to continue operating with relative success.
