WhatsApp just turned 10 and this hasn’t escaped the notice of cybercriminals. It appears that some party-poopers are not interested in the cake; they are just looking for ways to exploit the anniversary.

ESET Researchers received a WhatsApp message offering 1000GB of free internet data to celebrate the 10^th Birthday of WhatsApp. Unsurprisingly, it’s not a case of WhatsApp generosity as it is purported to be, and nor is the offer genuine. It is a scam that many unwittingly fell prey to.

Given that 10 is a big number and gifts to loyal members were in order, it would be a piece of cake to get an unwary user carried away by the fraudulent promotion.

What does the message say?

The message says, “WhatsApp Offers 1000GB Free Internet!” with a link to click for more details. Here’s what raises the red flag; the link isn’t an official WhatsApp domain, which makes us suspicious that all isn’t what it seems. However, given that many businesses have a propensity to run their promotions through third party organizations, in an attempt to validate fraudulent plays like the one we are just talking about, it’s not surprising to see that so many people clicked through.

Those who did, found themselves at a landing page, carrying the WhatsApp logo, and announcing: “We offer you 1000 GB free internet without Wi-Fi! On the occasion of our 10th anniversary of WhatsApp.” Not only is the message poorly composed, it is overlaid by a hideous yellow countdown sticker, listing the number of rewards left, creating a sense of urgency, and a survey question on the side asking how you found out about the offer.

Once the user is done answering all the questions, a pop-up explains that the promotional message must be shared with at least 30 other WhatsApp users before the user qualifies for the promotional giveaway.

Is any malware installed?

Upon further delving into the matter, ESET researchers found no evidence of any malicious software running at the back, or of any scraped personal information that could be changed at any time by the perpetrators. For now, the culprits seem content to “rack up bogus ad clicks that ultimately bring revenues for the operators”, asserts ESET. As expected, the fraudulent campaign is hosted by a domain that houses a plethora of brand-led so-called promotional offers from famous brands like Rolex, Nestle, and Adidas.

“What strikes us right off the bat here is that the URL that comes with the message is not an official WhatsApp domain,” the researchers said on Monday. Even though it is not uncommon for brands to run promotions through third parties from time to time, it is always prudent to check the company’s website to make sure any promotion is valid and real.

Can WhatsApp prevent this kind of scam?

This is yet another instant that proves how deep the degeneration of digital marketplace is. Even a highly secure app like WhatsApp can be vulnerable to easy exploitation by malicious actors. Some say that the “freemium” pricing strategy that offers free of charge services to all users, has been detrimental to both cybersecurity and privacy.

Even though ESET has guaranteed that the scam hasn’t phished for credentials, who is to say this won’t be the case next time as well. This seemingly innocuous prank could have done so much more damage. If that happened, you could end up losing significant sums of money and access to internet accounts– because hackers could gain control of your online identity. Cyber-boffins also warn that the scammers could potentially install “malicious software” on your device as well via the link.  

“The whole 1000 GB for WhatsApp 10th birthday seems legit,” Thornton-Trump says, “I mean who pays for WhatsApp? It’s a great attack to phish for credentials to WhatsApp and then pivot to other services on the largely correct assumption a common password will be used across all the victim’s accounts.”

So, the question remains: How can WhatsApp make sure this kind of scam doesn’t happen again?  The only thing WhatsApp can do is start a cyber counterintelligence campaign, go out in public and admit to users that this is a scam. Education seems to be our only hope in circumventing such wide scale frauds.

Claire Liam

See author's posts