Most of us have a mental tripwire for "my account got hacked": a password-reset email we didn't request, a text about a login from an unfamiliar city, an account suddenly locked. That tripwire made sense when the main threat was someone guessing or brute-forcing your password. It does almost nothing for the access methods showing up in recent incidents, which are built specifically to avoid tripping it.

Two examples from the past few weeks illustrate the pattern. Malwarebytes documented a WhatsApp scam (published August 3, 2026) where victims are walked through what looks like "WhatsApp Web setup" — sometimes on the real wa.me domain — and end up entering a code that links the attacker's device to their account. No password is typed anywhere, so no password-reset email fires and no failed-login alert triggers. The attacker's device just becomes another quiet entry on the account's linked-devices list, with full read and send access, which they then use to run the same scam on the victim's contacts. Separately, Microsoft warned of a campaign it calls "CaptiveCrunch" that intercepts travelers on hotel and conference Wi-Fi captive portals, redirecting them to fake login pages that harvest not just passwords but device codes and OAuth tokens — credentials that grant access without ever generating the kind of "new login" notice a password change would.

The common thread: both attacks target session and authorization mechanisms — linked devices, OAuth grants, device codes — rather than the password itself. Your account's built-in alerting was designed to watch the front door. These methods come in through a side door it doesn't monitor.

What to actually do about it

You can't wait for a notification that isn't coming. Instead, treat checking your own linked devices and authorized apps as a routine you run yourself, the same way you'd check smoke detector batteries. Here's a concrete pass, in order:

1. Check linked/active devices on messaging apps

  • WhatsApp: Settings → Linked Devices. Anything you don't recognize, tap it and "Log out."
  • Telegram: Settings → Devices. Same idea — end any session that isn't a device physically in your hand right now.
  • Signal: Settings → Linked Devices, same check.

2. Check active sessions and third-party app access on your core accounts

  • Google: myaccount.google.com/security → "Your devices" and "Third-party apps with account access." Revoke anything unfamiliar, and pay special attention to apps you granted access to months or years ago and forgot about — an old grant is just as usable to an attacker as a fresh one.
  • Microsoft: account.microsoft.com/security → "Sign-in activity" and "App permissions."
  • Apple ID: Settings → [your name] → check the device list at the bottom.
  • Facebook/Instagram: Settings → "Where you're logged in" / "Active sessions," plus "Apps and websites" for connected third-party access.

3. Be suspicious of any flow that asks you to enter a code rather than a password

Legitimate "link this device" flows do use codes — that's not inherently a red flag. What should stop you is the trigger: if a code-entry prompt shows up because of a message from a contact ("vote for me," "check this out"), a public Wi-Fi captive portal, or any link you didn't initiate yourself, treat it as hostile until proven otherwise. Close it and navigate to the app or account directly instead of continuing from the link.

4. Check whether your email has surfaced in a known breach

Have I Been Pwned (haveibeenpwned.com), run by security researcher Troy Hunt, is a free, well-established service for checking whether your email address appears in known data breaches — it's credible enough that national governments use it for their own domains (Nepal's national cyber security center became the 47th government to onboard, per reporting this week). It won't catch a linked-device compromise, but it's a fast, free check worth running on your primary email addresses, and it's the right first move if you suspect any account issue and don't know where to start.

5. On untrusted networks — hotel Wi-Fi, conference Wi-Fi, airport Wi-Fi — avoid logging into anything sensitive through the captive portal page itself

If a hotel or venue Wi-Fi login page prompts a software update, a "security check" dialog, or a Microsoft/Google login before granting internet access, be wary — connect first, then do your actual logins on your phone's cellular connection or a VPN rather than through whatever page the network hands you.

Put it on a calendar

A single cleanup pass fixes today's problem but not next quarter's. Pick a recurring reminder — quarterly is a reasonable cadence, or tie it to something you already do regularly, like a season change or a recurring bill — and run through steps 1 and 2 above for your two or three most important accounts: primary email, whichever messaging app you use most, and any account tied to your finances. It takes under fifteen minutes once you know where the menus are, and it's the only reliable way to catch access that was specifically designed not to alert you.