Meta has blocked WhatsApp accounts that were involved in “a small group of likely social engineering activities” on the service. In its report, the company revealed that it traced the activity to APT42 (also called UNC788 and Mint Sandstorm), which the FBI had previously linked to a phishing campaign targeting members of the Trump and Harris camps. The company said the suspicious activity on WhatsApp “targeted individuals in Israel, Palestine, Iran, the United States, and the United Kingdom.” It also appeared that the activity was focused on political and diplomatic officials, including people associated with both presidential candidates.
The criminals posed as technical support representatives from AOL, Google, Yahoo and Microsoft on WhatsApp. Meta did not disclose how they attempted to compromise their victims’ accounts. Some of those victims reported the activity to the company, which forced it to launch an investigation. Meta said it believes the perpetrators’ efforts were unsuccessful and that it has seen no evidence that the victims’ accounts were compromised. Meta nevertheless reported the malicious activity to law enforcement and shared information with both presidential campaigns.
Earlier this month, Google also released a report detailing how APT42 has been targeting prominent users in Israel and the US for years. The company said it had observed “unsuccessful attempts” to compromise the “accounts of individuals associated with President Biden, Vice President Harris, and former President Trump.” While Google described APT42’s attacks as “unsuccessful,” the group had successfully infiltrated the account of at least one prominent victim: Roger Stone, a close political confidant of Trump. The FBI had previously reported that he had fallen victim to phishing emails from the Iranian hackers, who then used his account to send more phishing emails to his contacts.
