WhatsApp Account Takeover Campaign (GhostPairing) · CIAD-2025-0055
CERT-In advisory CIAD-2025-0055 · 19 Dec 2025
Official title
CIAD-2025-0055 : WhatsApp Account takeover campaign (GhostPairing)
Official record
Open source pageSummary
Check the official recordWhat changed
CERT-In reports a high-severity cyber campaign called GhostPairing that exploits the WhatsApp device-linking feature to hijack user accounts. Malicious actors send deceptive links to victims to trick them into entering their phone numbers on fake websites. This action allows attackers to link their own browser as a trusted device to the victim account. Attackers then gain full access to messages, media, and contacts. They use compromised accounts to send messages to the contacts of the victim. Individuals must avoid suspicious links and verify linked devices in WhatsApp settings. Organizations must provide security training and monitor for social engineering indicators.
What you must do
- Do not click suspicious links.
- Do not enter phone numbers on external sites claiming to be WhatsApp or Facebook.
- Check linked devices in WhatsApp settings and log out unrecognized devices.
Document text
CERT-In Advisory CIAD-2025-0055
WhatsApp Account takeover campaign (GhostPairing)
Original Issue Date: December 19, 2025
Severity Rating: High
Description
It has been reported that malicious actors are exploiting WhatsApp’s device-linking feature to hijack accounts using pairing codes without authentication requirement. This newly identified cyber campaign, called GhostPairing enables cybercriminals to take complete control of WhatsApp accounts without needing passwords or SIM swaps.
The campaign usually begins with victims receiving a message, such as "Hi, check this photo", from a trusted contact. The message contains a link with a Facebook-style preview. The link leads to a fake Facebook viewer that prompts users to "verify" to see the content. Here the attackers exploit WhatsApp’s "link device via phone number" feature by tricking unsuspecting users to enter their phone number.
By following a short, seemingly harmless sequence of steps, victims unknowingly grant attackers full access to their WhatsApp accounts, without any password theft or SIM swapping. In a nutshell, the GhostPairing attack tricks users into granting an attacker’s browser access, as an additional trusted and hidden device, by using a pairing code that looks authentic."
Once the attacker links their device, they get almost the same access you would on WhatsApp Web:
They can read messages that sync to their device
They receive new messages in real time
They can view photos, videos, and voice notes
They can send messages as you
They can message your contacts and group chats
After taking over one account, attackers use it to send messages to the contacts of the victim.
Recommendations
It is recommended to take following actions to mitigate risks associated with account compromise or takeovers:
For Individuals
Do not click suspicious links even if they come from known contacts.
Never enter your phone number on external sites claiming to be WhatsApp/Facebook.
Check Linked Devices regularly in WhatsApp: Open WhatsApp and go to: Settings - Linked Devices If you see any device you don’t recognize, log it out immediately.
For Organizations
Provide security awareness training focused on messaging-app attacks.
Enforce mobile device management (MDM) where applicable.
Monitor for phishing and social engineering indicators.
Incident Response: Establish protocols for rapid detection and remediation.
References
Avast https://blog.avast.com/blog/onlinescams/whatsapppairingscam
CERT-In Securing social media accounts https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2024-0006
Preventing Online scams https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2024-0050
Source details
- Source
- Indian Computer Emergency Response Team
- Type
- advisory
- Published by source
- 19 Dec 2025
- Document number
- CIAD-2025-0055
- Issuing division
- CERT-In
- Coverage area
- cybersecurity