WhatsApp GhostPairing Lets Scammers Hijack Accounts Without Stealing Passwords

GhostPairing is a social-engineering campaign that tricks WhatsApp users into approving an attacker-controlled companion device via the legitimate device-linking workflow, allowing persistent access to chats without credentials; attackers can read messages, impersonate victims, commit payment/business fraud, and target contacts. The report highlights recent cases, explains the attack flow, and recommends reviewing Linked Devices, enabling two-step verification, using device screen locks, verifying urgent requests via independent channels, and reporting suspicious sessions to WhatsApp.