Hackers appear to have gained access for at least a few hours yesterday, Thursday, to the cell phone of Deputy Attorney General Savvas Angelidis, as demonstrated by an investigation conducted by digital forensics expert Alexis Mavrou, in connection with the scam text message sent in his name, regarding which the Police issued a press release.
Let us recall that the police reported yesterday that they are receiving reports from citizens regarding fraudulent messages in which the Deputy Attorney General, Mr. Savvas Angelidis, as the sender. According to the police report, the scammers are using his name and title in an attempt to lend credibility to their messages and mislead recipients.
ΣΧΕΤΙΚΑ ΑΡΘΡΑ
An investigation conducted by Alexis Mavros regarding the messages in question it ultimately became clear that this was not a case of Mr. Angelidis’s information being used, but rather of unauthorized access—without his consent—to his WhatsApp account via a parallel device connection.
As Mr. Mavros revealed while speaking on the “Alpha News” program, it appears that someone gained unauthorized access to the Deputy Attorney General’s WhatsApp account via a parallel device.
As Mr. Mavros explained, this is evidenced by the message itself, as well as by the fact that the message—according to the Deputy Attorney General— Prosecutor, did not appear in his account as having been sent.
To confirm the above, the expert witness said, a laboratory method called “Sun Box” was used.
“Imagine a glass sphere into which we can virtually place a virus and observe its movements and activities based on the stimuli we provide. So we went ahead and verified the entire process; we clicked on the link, and it brought up a page that was supposedly for voting for a young girl to attend ballet academy, and when we clicked on the next link to select the finalist, a pop-up appeared saying that we had to use WhatsApp to vote.”
From there on, there are two ways for cybercriminals to gain access:
“Either they ask for your phone number, so by entering your phone number, the attacker will send you a code that you’re supposed to use to vote, but that number is actually a verification code—it’s the code that gives them access to your WhatsApp and allows them to use it as a second device. A second method involves a barcode: if you scan it from WhatsApp without a second verification step, the attacker gains direct access to your WhatsApp and uses it.”
In Mr. Angelidis’s case, Mr. Mavros noted, it’s not just a matter of their information being used, but someone—at least yesterday—had access to his entire call and message history on WhatsApp.
The use of these malicious links, as Mr. Mavros explained, “is done via AI, so if someone, while using a connected device that was compromised through hacking, sends a message and immediately selects ‘delete for myself,’ it does not appear in the message history of Mr. Angelidis’s device—or anyone else’s—that it was sent. If ‘delete for everybody’ is selected, it appears that something has been deleted.”
Given the sequence of events, however, it does not appear—as a forensic expert assessed—that Mr. Angelidis was specifically the target of the hacking; he simply happened to be a link in the chain of this illegal activity.
Regarding the attackers’ motives in such cases, Mr. Mavros said that their goal is to obtain user data that they could potentially use either to steal money (e.g., photos of credit cards), or to threaten the victims—again with the aim of making a profit.
