Fake ballet vote on WhatsApp: the code that steals accounts

The message arrives on WhatsApp from someone you know, often dropped into an old conversation: "Hi! Sophie, the daughter of some friends of mine, is competing for a scholarship and a chance to perform on stage. Could you give her a vote?", with a link attached. There is no vote. The page asks for your number and then for a "verification code". That code links your WhatsApp to a scammer's device.

How the scam works

1. The bait comes from someone you trust. The contact who sent it has already had their own account taken over by the same scam. The person typing is the scammer, using their WhatsApp.
2. The page imitates a ballet competition. It uses the name of a real school in Prague, shows two finalists and a tight scoreboard ("only 5 votes to go"). The names change by country: Sophie, Sofie, Eliška.
3. To "confirm your vote", it asks for your phone number. At that moment, the scammer's server asks WhatsApp to link a new device to your account.
4. The page displays an 8-character code (for example, ABCD-1234) and walks you through entering it under WhatsApp › Linked devices › Link with phone number.
5. If you enter the code, you have handed your account to a device that isn't yours. You keep using WhatsApp as usual and notice nothing. The scammer reads your conversations and writes as if they were you.

That code is not the six-digit SMS registration code. It is WhatsApp's own official "link a device" code, which is exactly why the screen looks legitimate.

What happens next

Your account goes to work for the scam:

• it asks your contacts for money, with an urgent story ("I need to pay the dentist today", "lend it to me and I'll pay you back tomorrow");
• it sends the same voting bait to your address book, and every contact who falls for it hands over another account.

According to CyberX's investigation, the hijacked accounts are stored in a panel and can be exported in bulk and resold to third parties. A stolen account becomes merchandise.

What CyberX's investigation found

• The campaign is international and has been running since July 2026. The same page template appeared on at least 140 domains between 19 July and 30 October 2026, first in German and later in Spanish, French, Danish, Dutch, Polish, Icelandic, Portuguese and others: the page translates itself into more than 40 languages.
• In Brazil, the most widely circulated link was ballethfibs.cc, registered on 22 October 2026 and cited in an alert from the Tribunal de Justiça de Pernambuco. By 30 October the next version, awardancing.cc ("Audience Vote — International Dance Academy"), was already in circulation.
• The domains rotate almost daily, sit behind intermediaries and use privacy services in their registration. Blocking a single link solves nothing: the pattern is identical.
• An actual screen recording of the scam shows the form asking for the number and then the 8-character code generated by the scammers' server, complete with a "Copy" button and instructions for linking the device.
• The school whose name is used is a victim, not a participant. The First International Ballet School in Prague has published a notice stating that it runs no online voting and never asks for a verification code or WhatsApp login.
• Who is behind it. The technical setup (a panel with a team of "operators", an interface in Russian, Ukrainian and Belarusian, accounts stored and exported in bulk) matches a WhatsApp account-theft panel offered since December 2023 and described in 2024 by the security firm F6. According to CyberX's investigation, the scam is run with that tool.

What the investigation does not allow us to claim

• Who the people behind the panel are, or how many teams use it. The panel is sold to anyone who pays; the same tool may be in the hands of different groups.
• That the contact who sent the message was involved. They are, almost always, the previous victim.
• That every "voting" link is this scam. What identifies this one is the combination: a ballet or dance vote, a request for your number, and a code to "confirm".

If you received the message

• Don't click, and don't enter your number on any voting page.
• Call the person who sent it, by phone, and warn them: their account has most likely been taken over.
• Turn on two-step verification in WhatsApp: Settings › Account › Two-step verification, with a PIN only you know.

If you already entered the code

1. Open WhatsApp › Settings › Linked devices and log out of everything you don't recognise (it usually shows up as "Google Chrome" or a computer).
2. Enable or change your two-step verification PIN.
3. Warn your contacts, preferably through another channel, that any requests for money or votes coming from you in recent days were not yours.
4. If someone paid a request made in your name: the payer should go to their bank the same day to request a refund through the Pix MED mechanism and file a police report.
5. If the link you received is on the list on this page, or looks similar, tell us what happened through the form on our hub: every report helps connect the next waves.