Current phishing campaign targeting WhatsApp users

12. February 2026

The National CERT of the Republic of Serbia wishes to inform and warn all users about an ongoing phishing campaign being distributed via WhatsApp. Attackers are sending messages from known phone numbers, posing as contacts in the user's address book. The messages are related to an alleged contest, with users being invited to vote by clicking on a link contained in the message.

While the text and links in the message may differ, clicking on the link enables the attacker to connect their device as an additional device to access your WhatsApp account, which gives them the ability to read your messages, access your contact list, impersonate you and distribute malicious links to contacts in your address book on your behalf.

The National CERT recommends that, if a user receives such a message, they inform their contacts through an alternative communication channel that their account has been hacked and alert them not to access the links in the message.

The user is advised to find the ''Linked Devices'' option on their phone and if they notice an unknown device in the list of connected devices, immediately remove it from the list.

The website www.cert.rs uses cookies for improvement of user experience and website functionality. By continuing to browse this website, you agree to the use of cookies.

Details