Ghostpairing: New WhatsApp scam steals accounts via fake photo links

Ghostpairing is a new WhatsApp account hijacking technique that allows attackers to link a victim's account to their device without the victim losing access. Source: abc.es

How it works

The attack begins with a message from a compromised contact, often containing a link with a pretext like "¿Eres tú el de la foto?" or "Mira esta foto en la que te he etiquetado". Source: infobae The victim, upon clicking, is redirected to a fake Meta login page (impersonating Facebook or Instagram). By following the prompts, they unknowingly complete the pairing process, linking their WhatsApp account to the attacker's device. Source: abc.es This gives the attacker full access to conversations, files, and contacts, enabling them to impersonate the victim and spread the scam further. Source: infobae

Detection and prevention

Victims can check for unknown devices in WhatsApp's "Linked Devices" section. Source: abc.es Prevention includes avoiding suspicious links even from known contacts, and verifying messages via phone calls. Source: infobae Additionally, it's recommended to run an antivirus, change passwords, and inform contacts to prevent further propagation. Source: infobae