[Freeyemen]

thank you brother

[ramsesx]

Interesting, thanks

[BambinoCieco04]

that's so curious

[XYZSY]

lets see, btw thanks man

[ZzXx2020]

Great write-up, HackingRealm, and thanks for walking through the OhMyQR tool in detail. This is a classic example of social engineering paired with session hijacking, leveraging the trust users place in familiar interfaces like WhatsApp Web. The use of a malicious QR code to mirror the legitimate login process is clever, as it exploits both human behavior and the session persistence of WhatsApp’s WebRTC-based architecture.

A few technical observations:

The reliance on tools like scrot for screenshot capture and xdotool for automation suggests this attack is optimized for Linux environments (e.g., Kali), but it could theoretically be adapted to other OSes with similar utilities. The Ngrok integration for generating a public tunnel is a nice touch, bypassing NAT/firewall restrictions that might otherwise block direct connections—though it’s worth noting Ngrok’s free tier logs can sometimes expose the attacker if not proxied carefully.
The phishing page mimicking WhatsApp Web’s QR code is effective because it exploits the lack of client-side validation in the QR scanning process. WhatsApp doesn’t inherently verify the origin of the QR code beyond the session token, making this vector viable until the victim logs out or the session expires.
However, this method’s success hinges heavily on the social engineering component—convincing the victim to click the link and scan the code. Modern browsers and mobile OSes (e.g., Chrome’s Safe Browsing or iOS’s link previews) might flag the Ngrok URL as suspicious, reducing its efficacy against cautious users.
From a defensive standpoint, enabling 2FA on WhatsApp wouldn’t directly block this attack since it targets an active session post-authentication, but it could alert users to unauthorized login attempts if configured properly. A more robust mitigation would be for WhatsApp to implement stricter origin checks or time-bound QR codes, though that might degrade the user experience.

One critique: the post could benefit from mentioning OPSEC considerations—like anonymizing the Ngrok instance or using a VPS to obscure the attacker’s footprint. Without those, this setup risks deanonymization via server logs or traffic analysis. Still, it’s a solid proof-of-concept for educational purposes. Curious if you’ve tested this against WhatsApp’s latest builds—any updates on how their session handling might have evolved since mid-2023?

[ikersl]

thanks for the content

[Quoqe]

Thanks for this souir

[amnotfakeatall]

Is this what i think it is? Lets find out, im curious

[name987789]

Very interesting

[crotalys]

whats app is dangerous