Breaches and incidents
WhatsApp users (India): CERT-In warns of GhostPairing account takeover via device linking
CIAD-2025-0055 says attackers send “Hi, check this photo” from a hijacked contact, lead victims to a fake Facebook viewer that asks them to “verify” with...
- Disclosed
- Verification
- Checked against a primary source
What happened
- CIAD-2025-0055 says attackers send “Hi, check this photo” from a hijacked contact, lead victims to a fake Facebook viewer that asks them to “verify” with their phone number, and abuse WhatsApp’s “link device via phone number” pairing-code feature to add the attacker’s browser as a hidden linked device, with no password theft or SIM swap. The hijacked account then messages the victim’s contacts.
- Root cause: social engineering of the pairing-code flow.
- Attacker: unnamed criminals.
- Response: check Settings > Linked Devices and log out unknown devices; never enter your number on sites claiming to be WhatsApp or Facebook.