ADEX Uncovers WhatsApp Hijacking Scheme Hidden Inside a Gaming Ad Funnel

Fraudsters used paid Popunder traffic and a fake Free Fire promotion to trick users into linking attackers' devices to their WhatsApp accounts

LIMASSOL, Cyprus, Aug. 12, 2026 /PRNewswire/ -- ADEX, the anti-fraud and traffic-quality platform within AdTech Holding, has uncovered a WhatsApp account hijacking campaign disguised as a mobile gaming promotion and detected across the traffic of several of its clients.

Detected on July 20, the campaign targeted users in India through Popunder traffic. Fraudsters used a fake catalog of Free Fire-related apps to lead users through what appeared to be an installation and prize-verification process. ADEX identified and blocked the campaign.

Users first landed on a page designed to resemble a legitimate gaming app catalog. Clicking an installation button, however, did not start a download. Instead, users were asked to enter their phone number.

The page then displayed an eight-digit code and an interface resembling a WhatsApp device-linking prompt, instructing users to enter the code inside WhatsApp.

Behind the scenes, the attacker had initiated WhatsApp's legitimate "link with phone number" process from their own browser. By entering the code, the victim authorized the attacker's browser as a trusted linked device. The victim's phone continued to operate normally while the attacker gained access to WhatsApp conversations and media through the linked session.

WhatsApp pairing-code abuse has been documented before. What distinguishes the campaign detected by ADEX is its use inside a structured paid advertising funnel.

The attack began not with a suspicious message or obvious phishing page, but with a gaming ad followed by redirects, an app catalog, an installation prompt and a familiar-looking verification process.

"Fraudsters have moved from building look-alike pages to building actual conversion funnels," said Andrey Ivanov, CEO of ADEX. "They use targeting, recognizable brands, urgency and low-friction user journeys in much the same way legitimate advertisers do, but optimize the process for account compromise."

The case shows why reviewing only an ad creative or initial landing page may no longer be sufficient. Malicious intent can emerge only after redirects, form submissions and other user interactions, making end-to-end monitoring of the conversion journey increasingly important.

Media Contact
Michael Gor
+35797767567
[email protected]

SOURCE Adex