Kosovo WhatsApp accounts targeted by sophisticated cyberattack wave

A wave of sophisticated cyberattacks has targeted WhatsApp business accounts and private users in Kosovo, primarily affecting those using Telekomi i Kosovës (Vala) phone numbers. For over ten days, hackers have used phishing and social engineering techniques, such as “Ghost Pairing” and abusing the “Linked Devices” feature, to seize control of accounts without breaching WhatsApp’s core encryption.

Once access is gained, attackers use the compromised profiles to contact clients and partners, often requesting financial favors or emergency assistance. Some victims have reported that the issue may extend to SMS security, raising concerns about potential telecommunications breaches.

In response, KOS-CERT (the National Cyber Security Unit) has launched an investigation, collaborating with state institutions, mobile operators, and Meta to identify the attack mechanisms. KOS-CERT and local experts have urged citizens to enable two-step verification, avoid sharing verification codes (OTP), and immediately disconnect any unrecognized devices from their “Linked Devices” list.