Fake WhatsApp Web pages that link the victim's account to an attacker device, behind Chinese search-engine doorways

Fake WhatsApp Web login pages in Traditional Chinese that show a live QR code or ask for a phone number, so that scanning the code or entering the pairing code links the victim's WhatsApp account to a device the attacker controls. The phishing pages are reached only from search results. A large set of look-alike doorway domains registered in bulk in October 2026, such as webapi-whatsapp[.]com, webhwsapp-whatsapp[.]com and aggregator-whatsapp[.]com, shows search engines an article about WhatsApp Web, sends a visitor arriving from a search result on to a phishing page, and sends anyone else to a search engine or to WhatsApp's real site, so a direct visit shows nothing of the lure. Phishing hosts seen include web.boot-whatsapp[.]com, web.poly-whatsapp[.]com, docss-whatsapp[.]com and gm-whatsappt[.]com. The doorways use the same cloak script as the same operator's fake Google Chrome and WPS Office download sites. A match means a page carrying one of the phishing kit builds or the operator's visit tracker, or a scan of a known doorway server address or campaign host.