WhatsApp GhostPairing Hijacks Accounts Through Linked-Device Abuse

A social-engineering technique dubbed GhostPairing is being used to hijack WhatsApp accounts by abusing the app’s legitimate Linked Devices feature rather than stealing passwords or one-time codes. Attackers reportedly trick victims into approving an attacker-controlled companion device through deceptive QR codes, fake support interactions, messages, or other pretexts, giving criminals persistent access to chats while the victim may remain unaware.

Once a rogue device is linked, attackers can read messages, monitor conversations, impersonate the victim, and use the trusted account for payment fraud, phishing, identity abuse, invoice scams, and executive impersonation targeting business partners. Researchers said the tactic reflects a broader criminal shift toward abusing trusted digital workflows, and recommended that users review WhatsApp linked sessions, remove unknown devices, enable two-step verification, secure phones with screen locks, and independently verify urgent or unusual requests.