The Indian Computer Emergency Response Team (CERT-In) has issued a warning regarding a significant cybersecurity threat affecting WhatsApp users. This alert outlines an attack strategy known as GhostPairing, which enables cybercriminals to take control of WhatsApp accounts without the need for passwords or SIM card swaps. Here’s what you should understand about GhostPairing and how to protect your device.
CERT-In identifies GhostPairing as a risk associated with device linking
CERT-In explains that GhostPairing “enables cybercriminals to gain complete control of WhatsApp accounts without needing passwords or SIM swaps.” The advisory reveals that malicious actors exploit WhatsApp’s device-linking feature by convincing users to disclose one-time pairing codes.
Once these codes are acquired, the attacker can unlock the user’s entire WhatsApp account.
Understanding how GhostPairing functions
<pAs per CERT-In, GhostPairing attacks typically initiate with a deceptive message sent to victims from someone they trust. The message often reads, “Hi, check this photo,” accompanied by a link that resembles Facebook’s preview layout.
When victims click on the link, they are redirected to a fake Facebook page that requests “verification” to view the content. This process then prompts the user to enter their phone number using WhatsApp’s “link device via phone number” feature.
Unwittingly, the victim follows these steps, granting unrestricted access to their WhatsApp account. After the pairing is complete, the attacker’s device functions similarly to WhatsApp Web, allowing them to read messages (including real-time conversations), access all photos, videos, and voice notes, send messages as the account owner, and engage with contacts and groups directly.
The risks associated with GhostPairing
Once attackers have successfully paired their device, they can impersonate the account holder, communicating with their contacts or groups. This situation escalates as compromised accounts can be used to spread the threat further—sending similar deceptive messages to the victim’s contact list and increasing the threat’s reach.
Recommended measures to avoid GhostPairing on WhatsApp
CERT-In suggests several safety measures. Users are advised against clicking on suspicious links, even if they appear to come from known contacts. Additionally, phone numbers should never be provided to any external websites claiming to link to WhatsApp or Facebook.
Furthermore, it is recommended to routinely check the list of Linked Devices within your WhatsApp account. This list can be accessed through the app’s settings. Users should log out of any devices linked to their WhatsApp account that they do not recognize.