Turkish Cybersecurity Directorate Warns on WhatsApp: Accounts Hijacked via Outdated iPhones
The Presidential Cybersecurity Directorate (Cumhurbaşkanlığı Siber Güvenlik Başkanlığı) has warned the public against accounts on WhatsApp and similar messaging apps being hijacked and used for fraud. According to a press statement issued by the Directorate, complaints have recently increased that citizens whose accounts were taken over without their knowledge had their identities used to request money transfers by IBAN from people close to them.
According to the Directorate’s technical investigations, the attacks can involve malware that targets security flaws in iPhones running an outdated version of iOS. Such software can infect devices through malicious advertisements, suspicious links and compromised websites. The statement stressed that in some advanced attacks, merely viewing malicious content can put a device’s security at risk.
Attackers who gain unauthorised access to the device can reach personal information and messaging accounts and act in the user’s name, sending messages to contacts in the address book asking for money on the grounds of an “urgent need”. The Directorate said it should be borne in mind that a message arriving from an acquaintance’s genuine account may also have been sent without the account owner’s knowledge.
Measures recommended by the Directorate
- Updates: Operating systems and messaging apps should be kept up to date; iPhone users should install the latest security updates via Settings > General > Software Update.
- Suspicious links: Links of unknown origin, including social media advertisements, should not be clicked, and apps or files should not be downloaded from untrustworthy sites.
- Account security: Two-step verification should be enabled on WhatsApp, verification codes should never be shared with anyone, and the “Linked Devices” section should be checked regularly with unrecognised sessions closed. The Directorate also noted that in some advanced attacks, unauthorised access may not appear in this section.
- Verifying money requests: Even when they come from an acquaintance, IBAN and money transfer requests should be verified through a different channel, preferably by calling the person by phone.
What should those whose accounts are hijacked do?
According to the statement, anyone who suspects their account has been hijacked should warn those close to them through different communication channels, preserve digital evidence including suspicious messages and IBAN details, and apply to law enforcement units or Chief Public Prosecutor’s Offices (Cumhuriyet başsavcılığı). If a transfer has been made, the relevant bank should be contacted without delay; the phone should be reset and reinstalled with an up-to-date operating system, banking, social media and email passwords should be changed from a secure device, and multi-factor authentication should be enabled on as many accounts as possible.
The Directorate said it continues its monitoring, analysis and information activities on cyber threats. The statement did not disclose the name of the malware used in the attacks, the affected iOS versions or the number of complaints.
Related coverage
- Turkey’s Communications Directorate Launches Interactive NATO Summit Road-Closure Map for Ankara
- ALP 300-G: The Mobile Eye Watching Turkish Skies for Stealth Threats
- HAVELSAN Cyber and Homeland Security Solutions
Source: Press statement by the Republic of Turkey Presidential Cybersecurity Directorate.
