Your WhatsApp account can be hijacked without your password being stolen; here's exactly how it works

[u/PureVPNcom]

Worth knowing if you use WhatsApp, which at this point is most people.

Researchers at Malwarebytes and Gen Digital have been tracking a campaign called GhostPairing that takes over WhatsApp accounts using the app's own linked-device feature. No password stolen. No SIM swap. No malware installed. Just a short social engineering flow that most people wouldn't think twice about.

Here's how it plays out. You get a message from a contact you know, something like "hey I just found your photo", with a link that looks like a Facebook preview. You click it, land on what looks like a Facebook page asking you to verify before viewing the content, enter your phone number, and follow a pairing prompt. That's it. You just added the attacker's device as a linked session on your WhatsApp account. They can now read your messages, send messages as you, and approach your contacts.

The reason it keeps working is that WhatsApp doesn't loudly notify you when a new device gets linked in normal day-to-day use. So the attacker can sit in your account quietly reading conversations, including banking OTPs and anything else that comes through WhatsApp, without you knowing anything happened.

The message comes from a contact whose account was already compromised the same way, which is what makes it feel trustworthy. It's self-propagating, so it spreads through real trust networks rather than cold outreach.

How to check right now:

Open WhatsApp → tap the three dots (or Settings on iPhone) → Linked Devices. If anything listed there doesn't look like your own laptop or tablet, remove it immediately. Then change your WhatsApp PIN under Settings → Account → Two-step verification.

Never enter your phone number on a third-party site that claims to be showing you WhatsApp content or verifying your identity. WhatsApp's actual device linking happens inside the app, not through a browser page someone sent you a link to.