GhostPairing: New Attack Hijacks WhatsApp via Linked Devices, Tricking Users with Fake Facebook QR Code

A deceptive new cyberattack, dubbed GhostPairing, exploits WhatsApp’s linked devices feature to take control of user accounts without stealing passwords or SIM cards. According to Gen Digital, the campaign relies on social engineering rather than code exploits, beginning with a message from a compromised contact that links to a believable Facebook-style preview.

The victim is prompted to verify identity by scanning a QR code or entering a numeric code, which wires the attacker’s browser into the victim’s WhatsApp account through the platform’s own device pairing flow. Once linked, the attacker reportedly gains a persistent, invisible window into the victim’s conversations and can potentially spread malware further, all while the legitimate user remains unaware of the ghost device running in the background.

The researchers note that this technique exploits design patterns that prioritise seamless multi-device connectivity and does not involve traditional password theft or SIM swapping. GhostPairing was first detected in Czechia, but its language-agnostic approach suggests it could spread globally, underscoring the need for caution with quick QR scans and “approve on your phone” verification steps.