0 
0 This Article Only For Education Purpose Don’t try Real World
WhatsApp is the most widely used social app being used by people around the world to communicate, or as the younger generation likes to call it, ‘chat’ with their colleagues, family, and friends. It is a convenient way to communicate with one or a group of people simultaneously without worrying about carrier charges.
Now, although hacking into someone’s WhatsApp account is illegal, there are still a few legitimate reasons someone would want to snoop into another’s WhatsApp account.
Parents, for instance, want to have the assurance that their child is keeping good company. Monitoring their Children’s phones, or more specifically, monitoring their child’s WhatsApp can help them achieve that peace of mind.
That being said, bypassing WhatsApp’s strict encryptions and security is no child’s play. There are applications today that make hacking into the social app considerably smooth and simple.
The method relies on the mobile carriers’ automated service to forward calls to a different phone number, and WhatsApp’s option to send a one-time password (OTP) verification code via voice call.
It takes just a few minutes for the attacker to take over the WhatsApp account of a victim, but they need to know the target’s phone number and be prepared do some social engineering.
Sasi says that an attacker first needs to convince the victim to make a call to a number that starts with a Man Machine Interface (MMI) code that the mobile carrier set up to enable call forwarding.
Depending on the carrier, a different MMI code can forward all calls to a terminal to a different number or just when the line is busy or there is no reception.
These codes start with a star (*) or a hash (#) symbol. They are easily found and from the research we did, all major mobile network operators support them.
First, you receive a call from the attacker who will convince you to make a call to the following number **67* or *405*. Within a few minutes, your WhatsApp would be logged out, and the attackers would get complete control of your account
The researcher explains that the 10 digit number belongs to the attacker and the MMI code in front of it tells the mobile carrier to forward all calls to the phone number specified after it when the victim’s line is busy.
Once they tricked the victim into forwarding calls to their number, the attacker starts the the WhatsApp registration process on their device, choosing the option to receive the OTP via voice call.
After they get the OTP code, the attacker can register the victim’s WhatsApp account on their device and enable two-factor authentication (2FA), which prevents legitimate owners from regaining access.
If call forwarding has already been activated on the victim device, the attacker must use a different phone number than the one used for the redirection – a small inconvenience that might require more social engineering.
The most clear clue of suspicious activity for the target user occurs after the mobile operators turn on call forwarding for their device, since activation comes with a warning overlayed on the screen that doesn’t go away until the user confirms it.
Even with this highly visible warning, threat actors still have a good chance of success because most users are not familiar with the MMI codes or the mobile phone settings that disable call forwarding.
Despite these obstacles, malicious actors with good social engineering skills can devise a scenario that allows them to keep the victim busy on the phone until they get the OTP code for registering the victim WhatsApp account on their device.
Linuxtips Team has tested this method using mobile services from Airtel and Vodafone and also Jio and concluded that an attacker with a plausible scenario is likely to hijack WhatsApp accounts.
Airtel and Jio mobile carriers, each with more than 736.14 million customers as of September 2022, according to public data.
Protecting against this type attack is as easy as turning on two-factor authentication protection in WhatsApp. This feature prevents malicious actors from getting control of the account by requiring a PIN whenever you register a phone with the messaging app.
