A viral WhatsApp account hijacking scam involving fabricated voting requests for young girls named Sophie or Eliska has surged, targeting personal contact networks to orchestrate subsequent financial fraud.
A deceptive messaging campaign making the rounds on WhatsApp exploits trust. The scam begins when an account holder receives a seemingly harmless note from someone they already know. The outreach comes directly from a saved contact whose credentials have already been compromised.
The text typically reads in French: Hi, just a small favor to ask! Sophie, my friends’ daughter, needs your vote in a contest
as detailed in regional reporting. While the name Sophie appears frequently, researchers and victims have identified various alternatives, including a young girl named Eliska according to digital security coverage.
How Hackers Steal WhatsApp Accounts
Attached to the friendly appeal is a web link directing the recipient to a generic online voting portal. Once the target clicks through, the site prompts them to enter their mobile phone number. Shortly thereafter, the user receives an official WhatsApp notification asking them to authorize a new device connection.
Granting this authorization hands the attackers full access to run a parallel online browser session.
Armed with this session, the malicious actors can harvest the victim’s contact list. They can blast out the same voting hoax to friends and family, and even delete their own sent messages to keep the breach hidden from the account owner.
Jérôme Notin, director general of Cybermalveillance, the French public platform for cybersecurity assistance and prevention, noted that It’s a dormant threat, people don’t necessarily realize
that their messaging app has been hacked.
Fraudsters Demand Urgent Bank Transfers from Contacts
Once the intruders secure control of an active messaging profile, the nature of the outreach moves from social engineering to direct financial extortion. Victims have reported that unauthorized messages sent from their accounts asked contacts for urgent bank transfers to cover sudden medical consultation fees based on user accounts gathered by the news agency AFP.
Security researchers at Kaspersky originally documented the method in September 2025, but public defense agencies note a sharp acceleration in volume.
Jérôme Notin explained regarding the recent spike that At first glance, it has increased a lot since the weekend
.
Users Can Recover Accounts by Enabling Two-Step Verification
WhatsApp itself notes in its official support documentation that if you receive a suspicious message from a contact, it could mean that their account has been compromised
as stated on the platform’s help pages.
- Do not click on links promising online voting contests sent via chat, even if sent by a known contact.
- Warn the sender through an alternative channel that their account may be compromised.
- Check connected device sessions within the mobile application settings to log out unauthorized web browsers.
- Enable two-step verification to require an extra PIN code when linking new devices.
When approached for comment regarding the unfolding wave of account takeovers, representatives for Meta, the parent company of WhatsApp, had not responded immediately to inquiries from press agencies.