WhatsApp GhostPairing: 2024 Account Takeover Campaign Exploits Device Linking
In June 2024, cyber attackers launched widespread account takeover campaigns targeting WhatsApp users by exploiting the platform’s legitimate device-linking feature. This method, known as 'GhostPairing,' allows threat actors to hijack user accounts without requiring the victim’s credentials or multi-factor authentication codes. By intercepting or tricking users into sharing device-linking codes, attackers can remotely pair new devices to victims’ WhatsApp accounts, thus gaining complete access to conversations, contacts, and stored media. The campaign appears automated and has affected users globally, sparking concerns over the resilience of messaging platform identity controls. This incident highlights rising abuse of legitimate features and growing sophistication of social engineering tactics to bypass traditional security controls. Similar account compromise techniques are increasingly observed across the industry, prompting urgent calls for strengthened identity verification and robust monitoring of device association activities.
Kill Chain
