WhatsApp attack in Opole. Commentary by Dr. Adam Czubak from the Institute of Computer Science at the University of Opole.

September 18, 2025 – On Wednesday, September 17, many residents of Opole received a request on WhatsApp to “vote for Dorotka,” who was allegedly participating in a contest. The message looked innocent, came “from a friend,” was linguistically and graphically correct – and that is precisely why it proved to be an extremely effective social engineering technique. He spoke about the scale and mechanics of the attack in an interview with the Opolska360 portal.

What happened?
The attack exploited trust in the messenger and the sender. The link led to a page asking users to enter their WhatsApp code. As a result, a “second device” was connected to the victim’s account – the attacker gained access to messages and contacts, which allowed them to immediately scale the campaign to other people.

Dr. Adam Czubak from the Institute of Computer Science at the University of Opole points out that such campaigns deliberately “strike personally” – they appeal to the desire to help a child or friend. The domains and content are carefully prepared, without glaring errors, which further lulls people into a false sense of security. Nowadays, the principle of limited trust also applies to messages in instant messengers – account takeovers happen every day.

Key tips:
• Do not share SMS/WhatsApp codes with anyone or anywhere—no “contest” or “verification” requires such a code.
• Verify unusual requests through another channel (e.g., call the sender).
• Update your system and applications; this makes it more difficult to take over your device with a single click.
• Do not store confidential scans (ID cards, passports, archive passwords, etc.) in messengers and regularly delete sensitive messages.
• If you clicked and entered the code: immediately check and log out of “Connected Devices” in WhatsApp, report the issue to the platform, notify your contacts (preferably by text message), and consider changing your passwords for key services.

The full material with the statement by Dr. Adam Czubak can be found at the link below.