🚨 Phishing Analysis: From Rogue Tower to Linked Device: Anatomy of a WhatsApp Hijack Campaign

Date: October 2026 Target: Malaysian WhatsApp users Author: Mr Ayiezola

1. Executive Summary

There’s a live, well-built phishing campaign out there wearing a “WhatsApp Security Center” mask — and what it’s after isn’t your password. It’s your entire WhatsApp account. The hook is a text telling you your account got flagged for a policy violation and you’ve got two hours to “verify” or it’s gone. And the way that first text even reaches you is nastier than a normal SMS blast: the crew most likely pushes it from a Fake BTS (rogue cell tower) to slip straight past your telco’s filters. Click through and you land on a fake WhatsApp page — except there’s a real person on the other end of a chat, slowly talking you into linking their device with WhatsApp’s own 8-character linking code. Type that code in and it’s game over: full account hijack.

Full Chain Phishing ATO — WhatsApp Linked Devices hijack.

2. Threat Intelligence & Infrastructure

Here’s the core of what pulled during triage.

The lure, word for word:

“Your whatsapp account has been flagged for a policy violation! Please verify your identity within 2 hours to avoid account suspension: https://avvf[.]me/pltjd”

🚩 Red Flags

[!IMPORTANT] All three domains are brand new. They were registered between 19–22 September 2026 (NameCheap / GNAME), all parked behind Cloudflare, and the kit was live with fresh TLS certs within days. No history, no legitimate purpose, nothing to do with WhatsApp or Meta — that combo alone tells you everything.

3. Visual Analysis & Proofs

First, a bit of context: we already know that the Malaysian government has banned links in SMS messages to prevent people from falling for scams and fraud. As a result, a link no longer arrives through the normal mobile messaging system. So when someone receives an SMS that contains a link, they should be suspicious. If that happens, we can smell something abnormal — and that situation should raise your awareness.

MCMC: URLs no longer allowed for all SMS, here’s how to report them

How it lands — Fake BTS first, then a short link

The campaign has two delivery hops. The first one is the interesting part: a Fake BTS, the technique the TA most likely used to get the lure onto victims’ phones.

Method 1 — Fake BTS (False Base Station) SMS

Diagram of Fake BTS. This is AI generated image

A Fake BTS (a.k.a. false base station, cell-site simulator, or “IMSI catcher”) is exactly what it sounds like: a fake mobile tower that stands between the victim’s phone and the real network. The reason it works is a known GSM design gap: the mobile phone has to prove itself to the network, but the network never proves itself to the phone. So a rogue tower can pull nearby mobile phones onto it — often by forcing phones down from 4G/5G to 2G, which has no mutual authentication. Once the phones are connect to the fake tower, the operator can:

• Spoof the sender ID — the SMS can show whatever name or number they want (e.g. a “WhatsApp” alert), so it looks completely official.
• Bypass every telco filter — the message never touches the carrier’s SMS gateway, so spam/scam filtering simply never sees it.
• Hit everyone in range at once — no need to know a victim’s number; every mobile phone nearby gets the text. No SIM farm, no per-SMS cost.
• Leave almost no trace — no carrier logs tying the blast to the sender.

For the victim the tell is subtle: the phone may briefly drop to “2G / EDGE” or “No Service” just before an odd SMS lands from a sender that has no business texting you.

Figure 1: Lure message received — account "flagged", verify within 2 hours.

Why we believe this came from a Fake BTS: The message arrived as a standard SMS (not RCS or iMessage), showed the alphanumeric sender name “WhatsApp”, and contained a clickable URL. Since 1 September 2024, MCMC has required Malaysian telcos to block SMS containing URLs, and ordinary SIM-based scam senders cannot set a branded sender name like “WhatsApp.” A message with both characteristics reaching a phone strongly suggests it bypassed the carrier network entirely, which is exactly what a Fake BTS does. We did not capture radio-level evidence (such as the phone dropping to 2G at the time of receipt), so we classify Fake BTS delivery as highly likely rather than confirmed.

This message landed on my phone just as we were leaving a crowded area around Jalan Semarak. That fits the Fake BTS pattern, since rogue towers target busy places to reach as many phones as possible. Note also the sense of urgency (“verify within 2 hours”): a classic phishing pressure tactic designed to stop the victim from thinking clearly.

Fake BTS in the wild — Malaysia (2026)

This isn’t theoretical. Malaysian enforcers are chasing it right now:

• Johor Bahru, 6 Aug 2026 — MCMC and PDRM dismantled a Fake BTS SMS syndicate, arresting a 65-year-old local man caught operating a vehicle rigged with Fake BTS gear: two mobile phones, a SIM card, a GSM module, an antenna and the car itself. The rig beamed phishing SMS straight at high-density commuter areas in peak hours, specifically the Johor Bahru–Singapore crowd. It was one of six Fake BTS operations MCMC ran in 2026 (three in Johor, three in Genting Highlands). — NST, 11 Aug 2026
• Dewan Negara, 23 Feb 2026 — Deputy Communications Minister Teo Nie Ching said the devices hide inside vehicles or bags, letting syndicates “move dynamically” to dodge MCMC and PDRM — and that enforcement relies on public reports to pin down the exact location. — Berita Harian, 23 Feb 2026

Method 2 — The rotating short link

From there it’s the usual play: an urgency hook plus a rotating short link that bounces the victim onto a look-alike “WhatsApp Security Center”.

A. Landing Page Impersonation

WhatsApp branding, bilingual copy (Chinese by default, English on tap) — it is designed to make it look official.

Figure 2: Main landing page (Chinese default).

Figure 3: English variant of the same kit.

Figure 4: Form to lure victim to enter their phone number.

B. From Fake Page to Account Hijack

It stops being a “copy-paste phishing page” real quick:

1. It fingerprints you first: makes you pick Android or iPhone, then serves a matching skin in your language.
2. Then puts a human on the line: a real-time chat opens with an operator (the “REALTIME TALK” panel backend) who enggages with you and gradually builds your trust.
3. Then walks you into the trap: the operator tells you to open WhatsApp → Linked Devices → Link with phone number → and key in the 8-character code they provide.

Figure 5: Device-specific kit (iPhone).

Figure 6: Device-specific kit (Android).

Figure 7: Code accessing whatsApp account.

Indicators of Compromise (IoCs)

• URL: hxxps://avvf[.]me/pltjd
• WhatsApp Number: [Insert Phone Number]
• 8-character Linking Code: [Insert Code]

4. Technical Findings & Data Exfiltration

A. Infrastructure Recon

Once I got home and fired up my lab, I opened the link and started observing it: clicking around at random, changing VPN exits, rotating my User-Agent, and doing some subdomain enumeration and WHOIS lookups. That surfaced three domains in total — the two kit hosts, wsappcenter.com and apwscenter.com, and the lure domain avvf.me;

Digging into the domains, the usual tell-tales pop up:

• Registrars: NameCheap (wsappcenter.com, apwscenter.com) and GNAME (avvf.me).
• Registration window: 19–22 September 2026 — the whole thing is days old.
• Localization: the kit ships with zh-CN, zh-TW, en-US and es-ES skins, and defaults to country code +86.
• Certificate Transparency: Let’s Encrypt wildcard certs first issued 19–22 Sep 2026, re-issued 1 Oct 2026 — they keep it alive.

Figure 8: apwscenter.com is new registered domain.

Figure 9: wsappcenter.com new registered domain.

• Methodology: All analysis was passive and unauthenticated. Only retrieved files the server publicly served to any visitor (including via open directory listings), and we did not log in, guess credentials, use the panel’s authenticated API, or exploit any vulnerability.

B. Server Misconfigurations (What They Left Wide Open)

Sloppy hardening showed us the back room:

• Directory indexing: /assets/ and /assets/verification/ hand out open directory listings (a classic Go http.FileServer slip), leaking notify-bak.mp3 and extra locale files.
• Panel out in the open: /admin-login.html, /admin.js, /console.js, /sites.js, /templates.js were publicly reachable. The API’s auth-gated, but the entire operator UI downloads.

Figure 10: Exposed operator panel login ("REALTIME TALK" agent workstation).

Figure 11: Content exposed via open directory indexing.

C. The “Smoking Gun”: Exposed Origin IP

The biggest discovery from the whole thing (Actually i love this part :)): a DNS record that leaked the real origin.

Figure 12: Exposed origin IP Address.

Figure 13: Exposed AWS EC2 hostnames.

• Origin IP: 47.***.***.130 — AWS EC2, ap-southeast-1 (Singapore), ec2-47-***-***-130.ap-southeast-1.compute.amazonaws.com.
• Stack: nginx → Go, Debian 12. Ports 22 / 80 / 443 open (443 speaking plain HTTP).
• The bypass: Requests sent directly to the origin with the original hostname still returned the kit after the domain was suspended.

Figure 14: Phishing page kit has same body hash

Figure 15: Registrar status clientHold / NXDOMAIN after takedown.

Figure 16: Let's Encrypt wildcard certificate for domain apwscenter.com

Figure 17: Let's Encrypt wildcard certificate for wsappcenter.com

5. Kit Configuration & Backend

Pop the hood on the kit’s JavaScript and traffic, and you find the “brain” of the op.

A. Backend / Command & Control

• API: REST + Server-Sent Events (Go net/http) — /api/sessions, /api/conversations/{id}/events (SSE), /connect.
• Panel API: /api/auth/{login,logout,me}, /api/agent/{conversations,quick-replies}, /api/admin/sites — a multi-site, multi-agent panel (“Realtime Talk”, localStorage key realtime-talk-agent-read).

Figure 18: Client-side JavaScript files (admin.js, console.js) publicly served by the phishing server without authentication.

• The clever bit: Any information uploaded by the victim upload will gets pushed to a Cloudflare R2 bucket via pre-signed S3 URLs (connect-src https://*.r2.cloudflarestorage.com). Stashing it off-box means they keep the loot even if you kill a front-end node.

B. Geo-Targeting & Localization

• Attributes: free-text country-code field defaulting to +86; language skins for zh-CN, zh-TW, en-US and es-ES, with Simplified Chinese as the default.
• What the +86 default tells us: WhatsApp is blocked in mainland China, so mainland users are unlikely to be the real targets. The +86 default more likely points to the kit’s origin: it was probably built by, or for, a Chinese-speaking operator and left on its default setting.
• What the language skins tell us: The kit is built to run anywhere. Simplified and Traditional Chinese, English and Spanish cover a wide range of WhatsApp users, and the free-text country-code field means any number in any country works.
• Why Malaysia: Nothing in the kit is Malaysia-specific. Malaysia is targeted through the delivery, not the kit.
• Bottom line: a generic, multi-language kit pointed at Malaysian victims by a local delivery operation. Who built the kit and who runs the Malaysian campaign may not be the same people.

C. Operator Console

• Product: internal name “REALTIME TALK” (Chinese 坐席工作台) — A panel with live chat, quick replies, and multi-site tenancy.
• Kit signature: internal skin name “mango”; R2 project/bucket “netblaze”.

Figure 19: Operator login page.

6. Deep Dive: The Linked-Devices Hijack

Read the live-chat flow and it’s clear — this is social engineering, not a credential grabber.

The moving parts:

• A human operator. A live agent chats with the victim, running the same playbook as a fake bank/security call.
• Abuse of a real feature. They lean on WhatsApp’s genuine “Link with phone number” flow. No malware, no dodgy APK — just a code.
• Full Hijack. Once linked, they can access your message history, contacts, the ability to message as the victim, and interception of OTP/2FA codes — all through WhatsApp.

7. Multi-Domain / Rotating Campaign (2026)

They’re not betting on a single URL. A rotating shortener (avvf.me) 302s victims across a fleet of look-alike hosts, and only pre-provisioned campaign slugs resolve — a textbook anti-blocklist setup.

What has been found:

• Cluster A: whatsapp, whatsapp1–3.wsappcenter.com — clientHold (taken down 2026-10-04)
• Cluster B: ws1–ws4.apwscenter.com — ACTIVE
• Shortener: avvf.me — wildcard DNS (domain now NXDOMAIN)

Why it matters

Every node serves a byte-identical page (same hashes), all sharing the same backend and R2 exfil. That mirroring is pure redundancy: they killed wsappcenter.com and the campaign just kept humming along on apwscenter.com.

8. Prevention & Reporting

The one rule to remember: WhatsApp never asks you to verify your account through a link, nor does it asks you to share or enter an 8-character linking code given to you by a “support agent”. That code is a key to your account — treat it like your password.

Already entered a code?

1. Open WhatsApp → Linked Devices → remove anything you don’t recognise.
2. Turn on Two-Step Verification.
3. Warn your contacts - the attacker may message them while pretending to be you.

Official / Reporting:

• NSRC (National Scam Response Centre): call 997.
• Report the URL via Google Safe Browsing and SemakMule (PDRM).
• Report to MCMC / MyCERT (Cyber999) to get registrars, Cloudflare, AWS and Meta moving.
• Report Fake BTS / spoofed-sender SMS to MCMC and your telco — they can hunt the rogue tower, and it’s worth asking your carrier about disabling 2G where possible.

Detection ideas (blue team):

• Alert on 302s from shortener hosts to *.wsappcenter.com / ws*.apwscenter.com.
• Flag fake-brand pages whose CSP references r2.cloudflarestorage.com.
• High-confidence: <title>WhatsApp安全中心</title> on any non-whatsapp.com domain.
• Fake BTS: watch for mobile phones dropping to 2G/EDGE right before suspicious SMS, and treat spoofed-sender-ID blasts as a rogue-tower indicator.

Indicators of Compromise (summary)

Domains : avvf.me  wsappcenter.com  apwscenter.com
Hosts   : ws1-ws4.apwscenter.com ; whatsapp,whatsapp1-3.wsappcenter.com
Origin  : 47.***.***.130  (AWS EC2 ap-southeast-1) — nginx -> Go, Debian 12
Storage : Cloudflare R2 (pre-signed S3 uploads; bucket/account not retained)
CF edge : 104.**.**.84 172.**.***.248  (apwscenter.com)
SHA-256 : 31eb7c164e08ca4493b07fd3b86bd8d6b595c2682a655ce38db2fcc0b7d54b2e  index.html 
          34cd6ca4324d7890656efd1772bf48444ea4cd22bb10e61d785031c8104308a8  app.js
          209247dd28ccf82f8024906781fe057481ed217cf4062eef24419ecada5d6a71  style.css

Back to Home