The ghosts of WhatsApp: How GhostPairing hijacks accounts

Researchers have identified an active campaign targeting WhatsApp accounts, dubbed GhostPairing, which tricks victims into completing WhatsApp’s device-pairing flow and quietly adds the attacker’s browser as an invisible linked device. The attack relies on a fake login page that asks the user to log in with their phone number, after which the attacker submits a WhatsApp device-pairing request using that number.

Two variants have been observed: one that presents a QR code to scan with WhatsApp, and another that sends a numeric code for the user to enter to confirm a login. In the second variant, the user believes they are performing a routine verification, but they have actually linked the attacker’s browser to their account, giving criminals access to messages, media and chats. The campaign also enables attackers to impersonate the victim and spread the scam, potentially harvesting information for future abuse.

Malwarebytes recommends steps such as avoiding unsolicited links, enabling Two‑Step Verification in WhatsApp, and revoking access by using Settings → Linked Devices to log out of browsers and desktops not explicitly owned.