Loading story…
A new WhatsApp account takeover campaign, dubbed the GhostPairing attack, leverages social engineering to trick users into granting attackers access to their accounts without requiring password theft or SIM swapping. Victims receive a message from a trusted contact, typically stating "Hey, I just found your photo!" and containing a link that appears to be a Facebook preview. When the link is clicked, users are directed to a convincing fake Facebook page that prompts them to "verify" their identity. This process covertly guides the victim through WhatsApp's device-linking flow, resulting in the attacker's device being added as a linked device on the victim's account.
The attack exploits WhatsApp's legitimate device pairing feature, making the compromise appear as a user-approved action. The campaign was first observed in Czechia, with messages sent from compromised accounts to local contacts, and the infrastructure relies on a network of lookalike domains designed to mimic Facebook. Security researchers emphasize that there is no password theft or SIM swap involved; instead, the attack relies entirely on user manipulation. Users are advised to be cautious of unexpected messages, even from known contacts, and to scrutinize any requests to verify or link devices within WhatsApp.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Gen Digital publicly disclosed the GhostPairing attack, describing how attackers can gain persistent access to WhatsApp accounts without stealing passwords or performing SIM swaps. The disclosure detailed the campaign's propagation through compromised accounts, use of lookalike domains, and the broader risk posed by similar pairing flows on other platforms.
Gen Digital reported first observing a WhatsApp account-takeover campaign in Czechia that abused the platform's legitimate linked-device pairing flow. The attack used messages from compromised contacts and fake Facebook/Meta-themed pages to trick victims into linking an attacker-controlled device.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcecsoonline.com
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourceblog.avast.com
Open sourcegendigital.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A social-engineering technique dubbed **GhostPairing** is being used to hijack WhatsApp accounts by abusing the app’s legitimate **Linked Devices** feature rather than stealing passwords or one-time codes. Attackers reportedly trick victims into approving an attacker-controlled companion device through deceptive QR codes, fake support interactions, messages, or other pretexts, giving criminals persistent access to chats while the victim may remain unaware. Once a rogue device is linked, attackers can read messages, monitor conversations, impersonate the victim, and use the trusted account for payment fraud, phishing, identity abuse, invoice scams, and executive impersonation targeting business partners. Researchers said the tactic reflects a broader criminal shift toward abusing trusted digital workflows, and recommended that users review WhatsApp linked sessions, remove unknown devices, enable **two-step verification**, secure phones with screen locks, and independently verify urgent or unusual requests.
Jul 16, 2026
A rapidly expanding WhatsApp account hijacking campaign, dubbed HackOnChat by CTM360, is targeting users worldwide through a network of deceptive authentication portals and impersonation pages. Attackers exploit WhatsApp's web interface and use social engineering tactics, such as fake security alerts and spoofed group-invite messages, to trick users into compromising their accounts. The campaign leverages thousands of malicious URLs hosted on inexpensive domains, with a surge in activity noted across the Middle East and Asia. Once an account is compromised, attackers use it to target the victim's contacts for further scams, data theft, and extortion, often propagating the attack chain through phishing messages sent from the hijacked account. Research from UC San Diego highlights the broader social engineering strategies employed by scammers, including the use of long, trust-building conversations that often transition to WhatsApp as the preferred platform for executing fraud. The study found that scammers typically delay financial requests until after extensive interaction, using personal conversation and subtle verification techniques to build credibility. These findings underscore the effectiveness of WhatsApp as a tool for scammers and the sophistication of their methods in orchestrating account takeovers and subsequent fraudulent activities.
Jun 29, 2026
Security researchers and intelligence analysts have documented a series of incidents and trends highlighting the risks to mobile messaging accounts and devices. In December, a new form of WhatsApp account hijacking called GhostPairing was identified, where attackers trick users into linking an attacker-controlled browser to their WhatsApp device, potentially exposing sensitive information. Separately, researchers uncovered large-scale scraping of WhatsApp's contact discovery tool, resulting in the exposure of billions of phone numbers and associated profile data. Meanwhile, spyware threats targeting both iPhone and Android users have escalated, with zero-click attacks enabling adversaries to compromise devices and access encrypted messaging apps such as WhatsApp and Signal. Apple and Google responded by patching vulnerabilities believed to be exploited by commercial spyware like Predator, and the US CISA issued warnings about the active targeting of mobile messaging applications. In another high-profile case, the Iranian-linked Handala hacking group claimed to have fully compromised the mobile devices of two Israeli officials. However, forensic analysis revealed that only their Telegram accounts were breached, not the entire devices. The attackers likely used techniques such as SIM swapping, SS7 exploitation, and phishing to gain access, exposing gaps in session management and account security on encrypted messaging platforms. These incidents underscore the growing sophistication of attacks against mobile messaging services and the need for robust security measures, including privacy controls, passkey-encrypted backups, and vigilance against phishing and SIM-based attacks.
Jun 29, 2026