From Morocco to Lebanon: How I Infiltrated a Live WhatsApp Hacking Operation and Found the People Behind It
Last modified on April 20, 2026 • 9 min read • 1,726 words
So here’s a story I never thought I’d be telling. A few weeks ago, I found myself watching hundreds of WhatsApp accounts from my country get stolen in real time. And instead of just closing the tab, I decided to do something about it.
This is that story.
It Started With a Phone Call
Someone called me and told me something weird was going on. People were getting messages asking them to join a WhatsApp group, and something felt off. He sent me the link he received, and that’s when things got interesting.
The link opened a fake WhatsApp page. It asked for your phone number, then your SMS verification code, and sometimes even your PIN. The attack was not fancy at all. If you are a tech person, you have probably seen this type of trick before. But for regular people, especially older ones, it was convincing enough to fool hundreds of victims.
The Bait Was Simple, But Very Effective
The attackers were not doing anything technically complex. They created fake Facebook pages that looked similar to real, official ones. Then they used those pages to contact people and invite them to join a WhatsApp group through a link.
Once they had your number and verification code, they could take over your WhatsApp account instantly. And from there, the real damage began.
What Happened After Your Account Was Stolen
Once the attacker got into a stolen account, he used it to message the victim’s contacts. He targeted people close to the victim, like siblings, parents, and close friends asking for money. Payments were requested through physical bank cards or virtual cards.
A lot of people lost money. We are not talking about a few cases. This was happening at a massive scale, with victims sending photos of their credit cards, card numbers, CVV codes, and all the details needed to use them.
The fact that stolen accounts were then used to broadcast the phishing link and attack even more people made this spread incredibly fast. Every new account stolen became a new weapon to steal even more accounts.
How It Actually Worked (The Technical Part)
When I looked at the phishing site’s code, I found it was a simple single-page web app. There was no backend server. Everything was running in JavaScript, with some basic obfuscation added to hide the code from anyone who tried to read it.
The biggest mistake the attacker made was leaving his Telegram Bot token and chat ID sitting right there in the JavaScript code 🤭. This is what made it possible for me to access everything he was receiving.
Here is how the data flow worked step by step:
- The victim enters their phone number on the fake site
- The phone number is immediately sent to the attacker’s Telegram bot
- The victim is then redirected to enter the SMS code they received
- The SMS code is sent to the same Telegram bot as a second message, along with the phone number
I Got Inside Their System
Since the Telegram bot credentials were exposed in the JavaScript, I used a tool called TelePeek to connect to the bot and monitor everything happening in real time.
What I saw shocked me. Thousands of messages. Hundreds of stolen accounts. And this operation had been running since at least December 2025. This was not something that just started lately.
Also the attacker did not have a single phishing site, they had more than 25 phishing sites hosted on Netlify and Vercel (not all of them were up).
The speed was unreal. Tens of accounts were being stolen every single minute. Inside the bot, the attackers were sharing stolen credit card details with each other and planning how to cash out the money without getting caught, including using Razor gift cards.
This was not one person sitting behind a screen. It was a group, working together, and actively growing their operation.
The Race Against Time
When I realized what was happening, I froze for a few seconds. The live chat was scrolling fast. New victims every few seconds. And some of the phone numbers I saw belonged to people I actually know.
I had to act. But what should I do?
So I started calling people 📞.
The moment a phone number appeared in the bot, I would call that person and tell them not to enter their SMS code. Just close the site immediately and do not touch anything else.
Calling strangers and telling them they are being hacked right now was a strange experience. Some people thanked me. Some thought I was the hacker. Some hung up. And some were just confused, and started complaining that the site is so hard to use thinking I own it.
While calling people, I also emailed Netlify about the phishing site hosted on their platform. They responded quickly and took it down.
I thought that was the end of it, but it was not.
The Loop That Would Not Stop
Within a couple of hours, the attackers launched a new phishing site. I reported it. It was taken down. They launched another one. I reported it. It was taken down. This loop kept going.
Then things got worse. A local mayor’s WhatsApp account was compromised. Messages went out to almost the entire village. Another Telegram bot appeared. The scale was getting out of hand, and I needed a more scalable approach 😰.
I found a way to automatically delete incoming messages from the bot. This slowed the attack down significantly. New credentials were coming in but disappearing before the attackers could use them.
I ran the delete operation for a while, then paused to see how they would react.
That pause is when they started making mistakes 😉.
Who Is Behind This
When the messages stopped arriving, one of the hackers sent a voice message. He was cursing and confused about why the messages were disappearing.
I took that opportunity and replied to him with a fake error message containing a shortened link. That link was a Grabify tracking link. It was something like BOT ERROR (Link)
He clicked it 😅. Now I had his IP address and a location, it showed Morocco ?!
The IP was not a VPN or proxy. And it matched perfectly with the voice messages I had heard from inside the bot. The hackers were speaking Moroccan Arabic.
Everything started adding up. The IP address pointed to Morocco, Rabat. The voice messages were in Moroccan Arabic. Phone numbers starting with +212 (Morocco’s country code) appeared in the early bot test messages. Attackers usually test their tools before going live, and in this case they tested the phishing site using their own phone numbers. That was also a big mistake on their part.
When I connected to the second bot that appeared linked to a newer phishing site, I found it is older than the first one, where it had been running since November 2025. Also tested with their own number (different from the one detected previously).
After I sent the fake error message, one of the members panicked and mentioned the name of a group member inside the chat while trying to get that person to fix the problem. More information handed to me for free.
Also while digging I found multiple other pieces of information, including another name mentioned in a voice message, and one of the most important finds was a part of a member’s face visible in a video captured by him (his full face did not appear).
Lately they did restart the bot for some reason. After the restart, another Moroccan phone number was used to test.
To summarize what I collected on the attackers:
- Two first names
- Three phone numbers with +212 prefix
- A real IP address from Morocco, Rabat
- More than 100 voice messages in Moroccan Arabic
- A partial face image from a self-recorded video
But When It Comes to Lebanon…
This attack was not technically advanced at all. No complex malware. No sophisticated exploits. Just a simple phishing page, a Telegram bot, and social engineering. And it still caused massive damage.
That says a lot about where we stand when it comes to security awareness, especially here in Lebanon. The younger generation tends to spot these tricks more easily, but a large part of the population, especially older people, remains very vulnerable to even basic phishing attempts. Attackers know this, and that is exactly why they go after them.
What made this attack even worse was the timing. Lebanon is going through a war. People are stressed, scared, and not thinking clearly. In that kind of environment, you react fast without stopping to verify. You cannot afford to ignore a message that looks important.
And in Lebanon, WhatsApp is not just an app. It is how families stay in touch. It is how businesses operate. It is how people coordinate during emergencies. Losing access to it during a critical time is not just an inconvenience. For many people, it is a real crisis.
That impact is what pushed me to write this post.
What Now?
I do not know if the attackers will read this and recognize their own information here. But I am still watching them and waiting to track their next step. For some reason they stopped, they are still sending a couple of messages but they stopped the attacks.
I am still tracking the new domains they host and reporting them for takedown. I will continue monitoring their infrastructure and will keep posting updates on this blog as new information comes up.
For any OSINT analyst who wants to dig deeper into this case and help identify the real people behind this group, I am happy to share the full, unredacted information I have collected. Just reach out.
And if you or someone you know receives a suspicious link asking you to join a WhatsApp group through a website, do not fill in anything. Close it, report it, and warn whoever’s account the message came from.
Stay safe out there. 🛡️