GhostPairing Scam Can Hijack WhatsApp Accounts

A new cyber scam dubbed ‘GhostPairing’ has emerged as a serious threat to WhatsApp users, capable of taking over accounts without stealing passwords or swapping SIM cards. The attack exploits WhatsApp’s device-linking feature, allowing cybercriminals to gain silent and complete access to a user’s account.

The warning comes amid a rise in phishing and social engineering campaigns targeting messaging platforms. The newly identified attack has been classified as high risk due to its ability to bypass traditional security checks and operate without alerting the victim.

How GhostPairing works

The attack typically begins with a seemingly harmless message such as, “Hi, check this photo”, often sent from a contact that appears familiar or trustworthy. The message contains a link that shows a social-media-style preview, designed to lower suspicion.

When the link is clicked, users are redirected to a fake content viewer that prompts them to “verify” their identity to access the image or video. During this step, victims are misled into entering their phone numbers.

Unknowingly, users are granting permission for an attacker’s device to be linked as an additional trusted device. The process relies on pairing codes that appear legitimate, allowing attackers to bypass proper authentication checks. Once completed, the attacker’s device remains hidden, giving them persistent access to the account.

What attackers can access

After successfully linking their device, attackers gain access similar to WhatsApp Web or other linked devices. This includes:

• Reading messages synced to the linked device

• Receiving new messages in real time

• Viewing photos, videos and voice notes

• Sending messages from the victim’s account

• Accessing personal chats and group conversations

Because no password is stolen and no SIM card is compromised, many victims remain unaware that their account has been taken over.

How users can protect themselves

To reduce the risk of account hijacking, users are advised to follow basic digital safety practices:

• Avoid clicking on suspicious links, even if they appear to come from known contacts

• Never enter phone numbers on external websites claiming to be connected to WhatsApp or social media platforms

• Regularly review linked devices by navigating to Settings > Linked Devices within WhatsApp

• Immediately log out of any device that appears unfamiliar

Steps for organisations

Organisations are advised to strengthen security awareness among employees, especially regarding messaging-app-based scams. Training on phishing and social engineering tactics, mobile device management measures, and clearly defined incident response protocols can help limit damage and ensure quicker recovery in case of an account compromise.

As cybercriminals increasingly target everyday communication tools, vigilance and regular security checks remain the strongest defence against such attacks.