WhatsApp users are being cautioned about a new scam called “GhostPairing” that deceives them into providing attackers access to their accounts. This latest threat was recently uncovered by cybersecurity firm Avast, and it poses a significant danger as victims may remain unaware of the breach for an extended period.
In contrast to previous scams that primarily aimed to steal passwords, this scam can lead to more severe fraudulent activities. Experts emphasize that scammers gaining access to private chats, voice notes, and photos creates opportunities for impersonation, targeted scams, and even extortion.
The scam typically starts with the victim receiving a message from a trusted contact, claiming to have found their photo and providing a link. Clicking on the link redirects the user to a fake webpage resembling Facebook, requesting them to “verify” before viewing the image. However, this seemingly innocent security measure is actually part of WhatsApp’s device-linking process.
By entering a valid pairing code, victims unknowingly link the attacker’s browser as a device, granting continuous access to messages, photos, and contacts without the need for a password change or account lock. Once an account is compromised, it automatically sends messages to contacts, facilitating the spread of the scam.
To safeguard your WhatsApp account from such scams, consider the following preventive measures:
1. Check WhatsApp → Settings → Linked Devices and remove any unfamiliar devices.
2. Be cautious of any website requesting to scan a WhatsApp QR code or enter a pairing code.
3. Enable two-step verification and educate your family and group chats about potential risks.
By being vigilant and implementing these steps, users can better protect themselves from falling victim to the GhostPairing scam.
