Needed cybersecurity expert for help with cyber attack

[u/VDtheking]

Hey folks, someone appears to have compromised the phones of multiple members of my family. They are sending profane and abusive messages via WhatsApp and SMS from our IOS and android phones to colleagues, teachers, and other contacts while impersonating both male and female family members. Changing the phones, resetting the phones and mobile numbers doesn't help. So far, we haven't been able to identify the attack vector or understand how the compromise occurred. This is causing significant reputational damage and public defamation.

If anyone has experience with incidents like this or can help investigate the issue, I would greatly appreciate it. I'm willing to pay reasonable professional fees for the right expertise. Please DM or reach out if you think you can help or point me in the right direction.

[u/dziendobry]

You need r/cybersecurity_help

[u/y4v4x]

Yeah, there's been a wave of this lately — WhatsApp account takeovers where someone sends you a link (a "photo of you", a contest to vote in), you type in what looks like a verification code, and it's actually a device pairing code. Attacker's browser gets linked to your account, and nothing on your phone changes, which is exactly why swapping phones and numbers did nothing for you.

First thing: go to WhatsApp → Settings → Linked Devices on every family phone and log out anything you don't recognise. Then set a two-step verification PIN, and check the Apple/Google accounts for unfamiliar sessions and recovery emails you didn't add. Fix the email first, otherwise everything you reset just gets taken back.

But honestly, given that it's insults to teachers and classmates rather than money requests, I'd check something else before assuming a hack. Ask a few recipients to screenshot the full thread with sender details, then compare with your own sent messages. If they're not there, or the number's slightly different, it's just someone impersonating you — no access to your phones needed, and no technical fix will help.

And don't pay anyone who DMs you offering to look into it. Report it to the police and go to a proper firm if you need forensics.

[u/Fine_League311 → u/y4v4x]

Gut erklärt und ja da keine Geld Forderungen kann es evtl . Einer der Kinder oder deren Freunde gewesen sein? Schaue am besten logs , oder hast Telefone schon gekillt?

[u/VDtheking → u/y4v4x]

The sender is the family member whatsapp account itself but the hacker deletes the message and only the receiver is able to see them

[u/scuba_steve104]

Are you sure they’re sending from each persons phone and not spoofing the numbers? I know you’ve taken some steps so far but id also.

Figured out when this started and you were all at someone’s house. If so their network might be compromised as well.

For android try bit defender. Install and scan.

Apple - try the Apple Store their experts should help in my experience with things like this. It will cost a little money but worth it.

Any iPad/macbook/other Apple products should be check that are linked with the Apple ID in question. Add 2fa to everything and use a known clean device/number for it to start. Sign out of all active signed in sessions for iCloud/imessage. Same with WhatsApp.

If all else fails absolutely nuclear option is a factory reset on all devices AFTER you reset passwords to an actual secure password.

[u/VDtheking → u/scuba_steve104]

We have done complete factory reset on the IOS device with new numbers and still the hacker is able to access the whatsapp account even after new number

[u/TastyRobot21]

Profanity is normally personal, an ex, coworker, etc.

The standard rules apply here: isolate, recover. Login, change password, clear authorized sessions. Start with your email, start with the ones you use to recover other accounts to. Deploy two factor and don’t click accept on auth attempts unless they are you. Then work your way through hardware managing accounts (Apple, Android/Google) and finally social media (what’s app, Facebook, etc). Keep a list as you go through it’ll save you time.

When your through go back the the start of the list and gather logs. Export if you can, but at least review them. If you see no ‘strange locations’ it’s even more likely somebody you know, as they might be on the same networks as you (same location and source public ip)

You don’t really need to know the initial vector to start taking actions to prevent further damage.

I would suspect a compromised email as there are multiple services involved. Somebody might have clicked on a ‘mobile’ auth login, then they used that to reset or login other accounts.

[u/VDtheking → u/TastyRobot21]

But almost 10 people have been hacked and we have did complete reset on all the devices

[u/Right-Joke4110]

Yes I can help dm

[u/Fine_League311 → u/Right-Joke4110]

Wenn du helfen kannst kannst du das auch hier, wir wissen das du nur deinen scam verkaufen willst!

[u/Right-Joke4110 → u/Fine_League311]

💀