Hyderabad police warns of ‘GhostPairing’ WhatsApp scam exploiting device linking

Hyderabad police have warned users about ‘GhostPairing’, a new WhatsApp scam that exploits the app’s device-linking feature to hijack accounts through fake links. The scam relies on social engineering rather than hacking WhatsApp’s security systems.

Hyderabad: A highly deceptive WhatsApp scam is targeting users by abusing the app’s device linking feature. Dubbed as ‘GhostPairing’ by cyber security experts, it exploits the app’s device-linking feature to gain full access to a victim’s account without needing a password, an OTP, or a physical SIM swap.

The Hyderabad police issued an advisory following an alert by the national cyber security agencies. The Hyderabad Commissioner of Police, VC Sajjanar took to ‘X’ (formerly twitter), to warn the citizens about the new scam. “If you receive a message saying, “Hey, I just found your photo” with a link. Do not click it, even if it appears to come from someone you know,” he warned.

---

On clicking the link leads users to a fake webpage that mimics the official Facebook or WhatsApp Web interface, prompting them to “verify” their identity before viewing the content. This step triggers WhatsApp’s official device-pairing process, allowing the attacker to gain full WhatsApp web access, Sajjanar explained.

Instead of breaking WhatsApp’s security, GhostPairing relies entirely on social engineering. “Victims are conned into approving the attacker’s device themselves, making the attack both effective and difficult to detect,” said a cyber security expert.

After the account is compromised, scammers use it to send the same malicious links to the victim’s contacts and group chats. “Messages coming from known people are far more likely to be clicked, allowing the scam to propagate quickly without mass spam or obvious red flags,” point out the cyber security experts.

To stay away from the scam, the users should regularly check WhatsApp’s Linked Devices section and remove any unfamiliar sessions. Any message to enter pairing codes, scan QR codes, or “verify” accounts through external websites should be treated with suspicion.