<div class="flex flex-col text-sm pb-25">
<article class="text-token-text-primary w-full focus:outline-none [--shadow-height:45px] has-data-writing-block:pointer-events-none has-data-writing-block:-mt-(--shadow-height) has-data-writing-block:pt-(--shadow-height) [&amp;:has([data-writing-block])&gt;*]:pointer-events-auto scroll-mt-[calc(var(--header-height)+min(200px,max(70px,20svh)))]" dir="auto" tabindex="-1" data-turn-id="request-WEB:a02f0fca-8e86-45bc-b6e4-168152480f21-2" data-testid="conversation-turn-6" data-scroll-anchor="true" data-turn="assistant">
<div class="text-base my-auto mx-auto pb-10 [--thread-content-margin:--spacing(4)] @w-sm/main:[--thread-content-margin:--spacing(6)] @w-lg/main:[--thread-content-margin:--spacing(16)] px-(--thread-content-margin)">
<div class="[--thread-content-max-width:40rem] @w-lg/main:[--thread-content-max-width:48rem] mx-auto max-w-(--thread-content-max-width) flex-1 group/turn-messages focus-visible:outline-hidden relative flex w-full min-w-0 flex-col agent-turn" tabindex="-1">
<div class="flex max-w-full flex-col grow">
<div class="min-h-8 text-message relative flex w-full flex-col items-end gap-2 text-start break-words whitespace-normal [.text-message+&amp;]:mt-1" dir="auto" data-message-author-role="assistant" data-message-id="dfe58daa-9dda-4507-acb5-51582558caea" data-message-model-slug="gpt-5-2">
<div class="flex w-full flex-col gap-1 empty:hidden first:pt-[1px]">
<div class="markdown prose dark:prose-invert w-full break-words light markdown-new-styling">
<p data-start="263" data-end="573"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">A new cyber scam dubbed <strong data-start="287" data-end="305">&lsquo;GhostPairing&rsquo;</strong> has emerged as a serious threat to WhatsApp users, capable of taking over accounts without stealing passwords or swapping SIM cards. The attack exploits WhatsApp&rsquo;s device-linking feature, allowing cybercriminals to gain silent and complete access to a user&rsquo;s account.</span></p>
<p data-start="575" data-end="839"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">The warning comes amid a rise in phishing and social engineering campaigns targeting messaging platforms. The newly identified attack has been classified as high risk due to its ability to bypass traditional security checks and operate without alerting the victim.</span></p>
<h3 data-start="841" data-end="867"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">How GhostPairing works</span></h3>
<p data-start="869" data-end="1127"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">The attack typically begins with a seemingly harmless message such as, <em data-start="940" data-end="964">&ldquo;Hi, check this photo&rdquo;</em>, often sent from a contact that appears familiar or trustworthy. The message contains a link that shows a social-media-style preview, designed to lower suspicion.</span></p>
<p data-start="1129" data-end="1347"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">When the link is clicked, users are redirected to a fake content viewer that prompts them to &ldquo;verify&rdquo; their identity to access the image or video. During this step, victims are misled into entering their phone numbers.</span></p>
<p data-start="1349" data-end="1681"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">Unknowingly, users are granting permission for an attacker&rsquo;s device to be linked as an additional trusted device. The process relies on pairing codes that appear legitimate, allowing attackers to bypass proper authentication checks. Once completed, the attacker&rsquo;s device remains hidden, giving them persistent access to the account.</span></p>
<h3 data-start="1683" data-end="1712"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">What attackers can access</span></h3>
<p data-start="1714" data-end="1840"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">After successfully linking their device, attackers gain access similar to WhatsApp Web or other linked devices. This includes:</span></p>
<ul data-start="1842" data-end="2073">
<li style="font-family: georgia, palatino, serif; font-size: 12pt;" data-start="1842" data-end="1890">
<p data-start="1844" data-end="1890"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">Reading messages synced to the linked device</span></p>
</li>
<li style="font-family: georgia, palatino, serif; font-size: 12pt;" data-start="1891" data-end="1930">
<p data-start="1893" data-end="1930"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">Receiving new messages in real time</span></p>
</li>
<li style="font-family: georgia, palatino, serif; font-size: 12pt;" data-start="1931" data-end="1973">
<p data-start="1933" data-end="1973"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">Viewing photos, videos and voice notes</span></p>
</li>
<li style="font-family: georgia, palatino, serif; font-size: 12pt;" data-start="1974" data-end="2020">
<p data-start="1976" data-end="2020"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">Sending messages from the victim&rsquo;s account</span></p>
</li>
<li style="font-family: georgia, palatino, serif; font-size: 12pt;" data-start="2021" data-end="2073">
<p data-start="2023" data-end="2073"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">Accessing personal chats and group conversations</span></p>
</li>
</ul>
<p data-start="2075" data-end="2204"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">Because no password is stolen and no SIM card is compromised, many victims remain unaware that their account has been taken over.</span></p>
<h3 data-start="2206" data-end="2242"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">How users can protect themselves</span></h3>
<p data-start="2244" data-end="2344"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">To reduce the risk of account hijacking, users are advised to follow basic digital safety practices:</span></p>
<ul data-start="2346" data-end="2708">
<li style="font-family: georgia, palatino, serif; font-size: 12pt;" data-start="2346" data-end="2433">
<p data-start="2348" data-end="2433"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">Avoid clicking on suspicious links, even if they appear to come from known contacts</span></p>
</li>
<li style="font-family: georgia, palatino, serif; font-size: 12pt;" data-start="2434" data-end="2547">
<p data-start="2436" data-end="2547"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">Never enter phone numbers on external websites claiming to be connected to WhatsApp or social media platforms</span></p>
</li>
<li style="font-family: georgia, palatino, serif; font-size: 12pt;" data-start="2548" data-end="2646">
<p data-start="2550" data-end="2646"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">Regularly review linked devices by navigating to <strong data-start="2599" data-end="2628">Settings &gt; Linked Devices</strong> within WhatsApp</span></p>
</li>
<li style="font-family: georgia, palatino, serif; font-size: 12pt;" data-start="2647" data-end="2708">
<p data-start="2649" data-end="2708"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">Immediately log out of any device that appears unfamiliar</span></p>
</li>
</ul>
<h3 data-start="2710" data-end="2737"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">Steps for organisations</span></h3>
<p data-start="2739" data-end="3082"><span style="font-family: georgia, palatino, serif; font-size: 12pt;">Organisations are advised to strengthen security awareness among employees, especially regarding messaging-app-based scams. Training on phishing and social engineering tactics, mobile device management measures, and clearly defined incident response protocols can help limit damage and ensure quicker recovery in case of an account compromise.</span></p>
<p data-start="3084" data-end="3240" data-is-last-node="" data-is-only-node=""><span style="font-family: georgia, palatino, serif; font-size: 12pt;">As cybercriminals increasingly target everyday communication tools, vigilance and regular security checks remain the strongest defence against such attacks.</span></p>
</div>
</div>
</div>
</div>
<div class="z-0 flex min-h-[46px] justify-start">&nbsp;</div>
<div class="mt-3 w-full empty:hidden">
<div class="text-center">&nbsp;</div>
</div>
</div>
</div>
</article>
</div>
<div class="pointer-events-none h-px w-px absolute bottom-0" aria-hidden="true" data-edge="true">&nbsp;</div>

The method exploits WhatsApp’s device-linking feature

New cyber attack exploits device linking to take over WhatsApp without passwords

GhostPairing Scam Can Hijack WhatsApp Accounts

New cyber attack exploits device linking to take over WhatsApp without passwords

December 22, 2025 | 12:33 IST