WhatsApp users targeted by GhostPairing account hijacking scam

A new WhatsApp scam, referred to by researchers at Gen Digital as ‘GhostPairing’, is targeting users through deceptive messages. The scam typically begins with a message from a known contact claiming to have found a photo of the recipient, accompanied by a link.

When users click the link, they are directed to a fraudulent page designed to mimic Facebook. The page asks for a phone number and presents a security code. In reality, the attacker is simultaneously initiating an official WhatsApp device linking request. By entering the displayed code, the user inadvertently authorizes the attacker’s device to link to their WhatsApp account, granting the hacker access to the user's messages and account.