In October 2026, Corrata’s zero-day phishing protection (ZDP) began blocking a cluster of previously unseen domains on customer devices. When we investigated, we found a phishing campaign spreading through WhatsApp, in which a message from a trusted contact asks people to vote for a friend’s child in a competition. Anyone who follows the steps on the voting site hands control of their WhatsApp account to the attackers.
Most people know to be suspicious of an unexpected text claiming to be from their bank. This campaign works because the message comes from someone the victim already knows and trusts.
How the scam works
The message arrives from a contact’s WhatsApp account, which has most likely already been compromised by the same scam. It includes a link and asks the recipient to vote for a child taking part in a contest.
The site asks the victim to pick a contestant, then to enter their phone number and the code they receive.
That code links the victim’s WhatsApp account to a device the attackers control.
The site also offers a QR code to scan, which links the account in the same way.
Once linked, the attackers can read the victim’s new messages and send messages in their name, including the same voting link to everyone in their contacts. The victim’s phone carries on working as normal, so most people have no idea their account has been taken over.
The phishing pages are also built to stay out of sight. Each one loads only when visited through its full URL, and visiting the bare domain returns a 403 Forbidden error, which makes the sites harder for automated scanners to find.
Why this matters for organisations
Many employees use WhatsApp to talk to colleagues, clients, and suppliers, whether on a company phone or their own. A hijacked account gives attackers a view into those conversations and lets them message people as a trusted member of staff. Because the lure arrives through a messaging app, email security tools never see it, and mobile device management doesn’t close the gap either, because MDM and mobile threat defence do different jobs.
Indicators of compromise
We identified the following domains through our own detections and reverse IP lookups. They have been defanged so they can’t be clicked, and most are now offline.
- ballethfibs[.]cc
- czechballetschool[.]site
- awardancing[.]cc
- awardancing[.]ws
- awardancing[.]com
- awardancing[.]sbs
- awardancing[.]cfd
- besttack[.]top
- jordan-skill[.]com
- skill-bright[.]cyou
- sup-steel[.]click
- wiki-drell[.]online
Almost every phishing URL we saw used one of these two paths:
/p/29/#/l/vote2026m11
The domains resolved to two IP addresses, hosted in Czechia and France:
- 95.182.87[.]131
- 138.124.92[.]4
The hosting location shows where the servers are rather than where the attackers are. However, the website’s source code contains extensive comments written in Russian, which suggests it was built by Russian speakers. The code also makes repeated references to Telegram, suggesting the template may have been reused from an earlier scam targeting Telegram users. The site shows signs of being built with AI tools, including AI-generated images. A template that has already been adapted from one messaging app to another could easily be adapted for other countries and languages, so we expect this campaign may spread.
How Corrata detected the campaign
Corrata’s zero-day phishing protection (ZDP) assesses domains it has not seen before and quarantines them if they are judged risky. None of the domains in this campaign had been seen before, so ZDP assessed them, judged them risky, and blocked access, whether the link arrived by WhatsApp, SMS, or any other app. This stopped users before they ever reached the page asking for their phone number, so customers were protected before the scam had a name.
How to keep yourself safe
- Never enter a code into a website: WhatsApp verification and pairing codes are only ever needed inside the WhatsApp app. If a website asks you to enter your phone number and then a code you’ve just received, close it, because that is how attackers link your account to their device.
- Check your linked devices: Open WhatsApp settings, go to Linked devices, and review everything listed there. If you see a device you don’t recognise, log it out straight away.
- Turn on two-step verification: This adds a PIN that’s needed whenever your number is registered on WhatsApp, which makes it much harder for someone to take over your account.
- Confirm unusual requests with the sender: If a friend sends you a link asking you to vote, donate, or log in, call them or message them on a different app to check they really sent it. Their account may have been compromised.
- Treat links on every platform with caution: Phishing now arrives through WhatsApp, Telegram, social media, and QR codes as well as SMS and email, often from people you trust.
For organisations
Staff can’t be expected to spot a convincing link from a friend every time, so protection needs to work at the device level through mobile threat defence. Corrata’s zero-day phishing protection blocks links like the ones in this campaign whichever app they arrive through, even when the domain is brand new.
To see how it works, request a demo.
