WhatsApp device linking abused in account hijacking attacks

Threat actors running a campaign called "GhostPairing" are abusing WhatsApp’s legitimate device-linking workflow by luring victims to typosquatted Facebook-like pages that prompt them to enter pairing codes; once entered, attackers gain real-time access to messages and media, can impersonate users, and use compromised accounts to spread the scam. First observed in Czechia, the phishing campaign relies on social engineering rather than technical exploits; recommended mitigations include checking Settings → Linked Devices, blocking/reporting suspicious messages, and enabling two-factor authentication.