Technique

Group Hijacking

Also known as: Community Takeover, Group Flipping, Admin Compromise, Group Selling, Admin Rights Sale, Community Pivot Scam

MANIPULATION

Purchasing admin access or compromising social media groups to pivot established communities toward scams, disinformation, or fraud while exploiting members' existing trust.

Common attack flows

How it fits in a scam

This technique shows up duringMANIPULATION

Before

This is often where the scam begins.

After

Defense

How to defend against this

How to spot it

  • Sudden change in group topic or focus
  • New admins appearing without explanation
  • Established community suddenly promoting crypto or investments
  • Group rules changing to allow previously banned content
  • Long-time members expressing confusion about new direction
  • Group invites you to download an app to register for activities
  • Requests for sign-up fees via Messenger or WhatsApp after joining
  • AI-generated content in group posts with stock-looking images
  • Group history shows recent name or topic changes
  • Original admin accounts show signs of compromise

Seen in the wild

Where we’ve seen it

Commonly targets

Further reading