BleepingComputer reports that WhatsApp's device-linking functionality has been exploited to enable account takeovers as part of the new GhostPairing attack campaign, which was initially conducted in Czechia but could easily be deployed in other regions.
Intrusions commence with the delivery of a short illicit message from a known contact that includes a link purportedly leading to a photo of the recipient but redirects to a counterfeit Facebook verification page, according to Gen Digital researchers. Inputting the requested mobile number triggers WhatsApp's device-linking process, with the messaging platform producing a pairing code displayed on the bogus page, which when entered, allows threat actors to obtain total account access.
"Many victims are unaware that a second device has been added in the background, which is what makes the scam even more dangerous criminals are hiding in your account, watching your every conversation without you even knowing it," said Gen Digital, which urged users to monitor unauthorized devices within the app's Settings menu.
