CERT-In Advisory
CIAD-2025-0055
WhatsApp Account takeover campaign (GhostPairing)
Original Issue Date: December 19, 2025
Severity Rating: High
Description
It has been reported that malicious actors are exploiting WhatsApp’s device-linking feature to hijack accounts using pairing codes without authentication requirement. This newly identified cyber campaign, called GhostPairing enables cybercriminals to take complete control of WhatsApp accounts without needing passwords or SIM swaps.
The campaign usually begins with victims receiving a message, such as "Hi, check this photo", from a trusted contact. The message contains a link with a Facebook-style preview. The link leads to a fake Facebook viewer that prompts users to "verify" to see the content. Here the attackers exploit WhatsApp’s "link device via phone number" feature by tricking unsuspecting users to enter their phone number.
By following a short, seemingly harmless sequence of steps, victims unknowingly grant attackers full access to their WhatsApp accounts, without any password theft or SIM swapping. In a nutshell, the GhostPairing attack tricks users into granting an attacker’s browser access, as an additional trusted and hidden device, by using a pairing code that looks authentic."
Once the attacker links their device, they get almost the same access you would on WhatsApp Web:
- They can read messages that sync to their device
- They receive new messages in real time
- They can view photos, videos, and voice notes
- They can send messages as you
- They can message your contacts and group chats
After taking over one account, attackers use it to send messages to the contacts of the victim.
Recommendations
It is recommended to take following actions to mitigate risks associated with account compromise or takeovers:
For Individuals
- Do not click suspicious links even if they come from known contacts.
- Never enter your phone number on external sites claiming to be WhatsApp/Facebook.
- Check Linked Devices regularly in WhatsApp:
- Open WhatsApp and go to:
- Settings - Linked Devices
- If you see any device you don’t recognize, log it out immediately.
For Organizations
- Provide security awareness training focused on messaging-app attacks.
- Enforce mobile device management (MDM) where applicable.
- Monitor for phishing and social engineering indicators.
- Incident Response: Establish protocols for rapid detection and remediation.
References
Avast
https://blog.avast.com/blog/onlinescams/whatsapppairingscam
CERT-In
Securing social media accounts
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2024-0006
Preventing Online scams
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2024-0050
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-22902657
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|