Labor frontbencher Anne Aly regained control of her WhatsApp account after a phishing link, forwarded from a compromised friend, tricked her phone into spamming contacts with a fake scholarship voting request.
A spokesperson for the minister for multicultural affairs, small business and international development said Aly opened the link believing it came from a trusted contact. The message asked recipients to "cast a vote for Nora", described as a friend's child competing for a study scholarship. SBS News saw the text and reported that tapping the URL spread the same personalised bait to other users' contact lists. Aly secured the account and reported the incident to authorities.
How the scam spread
WhatsApp takeover scams often begin with social-engineering messages that exploit familiarity. Because the plea referenced each recipient by name and originated from a known number, victims may lower their guard compared with anonymous SMS phishing. Once the malicious link executes, attackers can broadcast similar texts without further user action until the account is recovered through two-step verification resets.
Aly's office emphasised that anyone can be targeted and urged Australians to treat unexpected links skeptically, even when they appear to come from friends or colleagues. Independent MP Zali Steggall faced a comparable breach in March, when both personal and government devices were affected amid a broader wave of phishing against public figures.
Why officials are alarmed
The Australian Signals Directorate's latest annual cyber threat report noted adversaries and criminals "weaponising empathy, urgency and trust" to bypass corporate controls. For elected officials, compromised messaging apps pose national-security as well as personal risks: contact lists include diplomats, constituents and journalists. Aly holds portfolios touching diaspora communities, making rapid communication vital; downtime while securing accounts can delay crisis responses.
Agencies recommend reporting incidents to the Australian Cyber Security Centre and enabling device hardening on parliamentary-issued hardware. The Department of Home Affairs has been expanding protective services for parliamentarians after high-profile spear-phishing attempts against US officials this year.
What users should do
Security practitioners advise verifying unusual requests through a separate channel — a phone call or face-to-face confirmation — before clicking links. Enabling WhatsApp's security notifications alerts users when a contact's encryption key changes, a possible sign of account takeover. Organisations should rehearse comms plans for when executives' personal apps are compromised, because many ministers mix official and private devices despite hardening guidance.
For the public, Aly's experience is a reminder that scam grammar is improving and distribution can piggyback on trusted graphs. Voting contests, parcel-delivery failures and toll-road fines remain common lures. Reporting to Scamwatch helps the National Anti-Scam Centre map trending scripts, even when losses are minimal. Aly declined further comment beyond the initial statement, focusing on restoring secure channels before parliament's next sitting week.