GhostPairing campaign abuses WhatsApp device linking to hijack accounts

GhostPairing is a campaign that abuses WhatsApp’s device-linking feature to hijack accounts via pairing codes, without requiring authentication, according to Gen Digital. The campaign was first observed in Czechia, but Gen Digital warns that it can spread globally through compromised accounts. Victims receive messages from trusted contacts containing links to fake Facebook lookalike domains, which lead to a fake Facebook viewer prompting users to verify content.

Followers are shown a minimal page that asks for a QR code or a numeric code to be entered in WhatsApp, and by inputting the code, the attacker’s browser is linked as a trusted device, granting full access to messages, photos and account activity. Once linked, attackers can read chats, download media, impersonate victims and spread lures to contacts, with the victim’s phone continuing to work normally and often remaining unaware of the second linked device.

The report also notes that the technique relies on legitimate features and social engineering rather than password theft, enabling rapid, pervasive abuse via trusted relationships.