New ‘GhostPairing’ Technique Enables Undetected WhatsApp Access

GhostPairing is a social-engineering campaign that exploits WhatsApp’s multi-device pairing to stealthily link an attacker’s device to a victim’s account. Victims receive deceptive links that lead to a fake login page which captures their phone number; the attacker then initiates WhatsApp device pairing and tricks the user into entering a pairing code, granting the attacker persistent, invisible access to chats. The attack is stealthy (attackers remain dormant to avoid detection) and can be used for reconnaissance, impersonation, or blackmail; recommended mitigations include avoiding suspicious links, verifying link destinations, reviewing linked devices in WhatsApp, and notifying contacts if compromised.