Basically, once they've hacked your friend, you get a message in WhatsApp from your friend saying that they need to get a code sent to you and can you send it to them. Don't because they will then hack your WhatsApp and the cycle continues. I put 2 factor authentication on so I don't think they have actually hacked me fully, but they've tried to get in so many times that both I and presumably the hacker are now locked out for 12 hours. Massive PITA. My friend's number has now been changed to have a country code from Pakistan. So yeah.