A new wave of cyber fraud targeting mass account takeovers in popular messengers Telegram and WhatsApp is simultaneously being reported in Ukraine and Kazakhstan. The attack is triggered by an innocent-looking message from an "acquaintance": a request to vote for a child in a contest. According to the Center for Countering Disinformation (CCD) under the NSDC of Ukraine, this request hides a phishing link that, if clicked, leads to the loss of account access. Law enforcement in Kazakhstan, where the scheme has already yielded its first documented results, reports the same mechanism and dozens of victims.
"Vote for my child": how the scheme works
According to the CCD, victims receive a text like "Vote for my daughter, number 5 in the contest!" or "vote for Sasha Savenko"—with the names constantly changing. These messages are sent from numbers already in the recipient's contact list, which increases trust. As soon as a person clicks the link, the deception mechanism is activated: the messenger account is hacked, and its true owner loses control over their correspondence. The attackers then use the hijacked profile to steal personal data, extort money from friends and family, and commit other illegal acts, including sending requests to urgently transfer funds "to unblock an account."
One scheme — two states
In Ukraine, the CCD emphasizes that no messenger guarantees absolute protection against fraud and hacking, but proper security settings can significantly reduce risks. In Kazakhstan, the scheme has already moved into a mass phase: according to police data, in just one northern region, 14 hacking incidents have been officially registered in a few days following this model. They also note typical request amounts ranging from 10,000 to 80,000 tenge, and scammers, as a rule, do not engage in lengthy correspondence. In parallel, a related attack variant is spreading: messages with the format "Look, isn't this you in the photo?", which infects the device with malware upon clicking.
How to secure your Telegram account
The CCD recommends starting with the "Privacy and Security" section: enable two-step verification, set an additional password for login, and link an email address for account recovery. In the same section, you should check who can see your phone number, profile photo, and last activity time, and restrict the circle of users who can add you to groups and channels by setting exceptions. Separately, in the "Devices" section, you need to review the list of active sessions and terminate any unknown or long-unused ones. Additionally, the CCD advises setting up a Telegram passcode lock and automatic app locking — this will protect your correspondence if someone gains physical access to your phone. Menu items may vary depending on your device and app version.
What to do if access is already lost
If your messenger has already been hacked, Kazakh law enforcement advises reinstalling the app and strengthening security. Until then, ignore any incoming requests for money sent from your own number. If you receive a "vote for a child" or "look at this photo" message, do not click the link, even if it comes from a close friend or relative: verify the information via voice call or another channel first. Experts in both countries agree: privacy settings and the list of connected devices should be checked periodically, and messages asking you to vote or click a link should be treated with suspicion, regardless of who sent them.
