ISLAMABAD – Cybersecurity experts sound alarm as hackers exploit user trust, turning WhatsApp’s own features into powerful weapons for mass account takeovers.
A new WhatsApp scam has reported, and experts warn it could spread faster than most users realize. Known as “GhostPairing,” the fraud allows hackers to take full control of WhatsApp accounts without cracking encryption or stealing passwords, simply by manipulating users into approving access themselves.
The new method shows disturbing shift in cybercrime, where psychological deception is as effective as technical hacking. The attack starts with message that appears to come from a trusted contact, a friend, family member, or someone the victim knows. The message usually contains a tempting link, often claiming to show the recipient’s photo.
But clicking the link leads to a fake Facebook login page, not a photo. Victims are asked to enter their phone number. Instead of logging in, the fake page secretly triggers WhatsApp’s legitimate “Linked Devices” pairing feature and displays a pairing code. The user is then instructed to enter this code in WhatsApp.
By doing so, the victim unknowingly links their WhatsApp account to a device controlled by the hacker. No password is stolen. No encryption is broken. No security system is technically “hacked.” The user approves the access themselves, and that’s the most dangerous part.
What did hackers get from this?
Once paired, hackers receive real-time access to all media content, including your messages, pictures, videos and even voice notes.
Even worse, attackers can message the victim’s contacts, impersonating them and spreading the scam further, creating a snowball effect that can hijack accounts at scale.
Cybersecurity experts warn that many victims may not even realize their account has been compromised.
In recent times, attackers are exploiting familiar, everyday security behaviors, like QR codes, device pairing prompts and verify on your phone screens. “Fraudsters are persuading people to grant access themselves. Scams like GhostPairing turn trust into a weapon.”
The threat goes beyond WhatsApp, as any platform using fast, low-visibility device pairing systems could be at risk.
How to Check If Your Account Is Compromised
WhatsApp users should immediately:
- Open WhatsApp Settings
- Go to Linked Devices
- Review all connected devices
- Remove any device you do not recognize
Security experts say this simple check could prevent serious privacy breaches.
As cyberattacks become more deception-driven, experts argue that security systems must evolve to account for what users are being tricked into doing, not just what they do intentionally.
WhatsApp rolls out message translations feature; how to use it
