Indian cyber agency warns of WhatsApp ‘GhostPairing’ account hijack

CERT-In has flagged a high-severity WhatsApp vulnerability called GhostPairing, which allows attackers to hijack accounts via the device-linking feature. Cyber criminals can access messages, photos, and videos without passwords or SIM swaps. Users are advised to avoid suspicious links

New Delhi: Indian cyber security agency CERT-In has flagged a vulnerability in the WhatsApp “device-linking” feature that enables attackers to take “complete” control of an account, including access to real-time messages, photos, and videos on the web version.

The agency named the issue “GhostPairing” on Friday in an advisory that has been accessed by PTI. “It has been reported that malicious actors are exploiting WhatsApp’s device-linking feature to hijack accounts using pairing codes without authentication requirements.

---

“This newly identified cyber campaign called GhostPairing enables cyber criminals to take complete control of WhatsApp accounts without needing a password or SIM swaps,” the advisory said.

A response from WhatsApp to the revelation is awaited. The Indian Computer Emergency Response Team (CERT-In) is the national technology arm to combat cyber attacks and guard the Indian Internet space.

The advisory said that the “high” severity attack campaign usually begins with the victim receiving a message like “Hi, check this photo” from a “trusted” contact. The message contains a link with a Facebook-style preview. The link leads to a “fake” Facebook viewer that prompts users to “verify” to see the content. Here, the attackers exploit WhatsApp’s “link device via phone number” feature by tricking unsuspecting users into entering their phone numbers, the advisory said.

This way, the victims “unknowingly” grant the attackers full access to their WhatsApp accounts. The ‘GhostPairing’ attack tricks users into granting an attacker’s browser access, as an additional trusted and hidden device, by using a pairing code that looks authentic.

The advisory said that once the attacker links their device, they get almost the same access as the victim would get on WhatsApp web. They can read messages that sync to their device, receive new messages in real-time, view photos, videos, and voice notes, and they can send messages to the victim’s contacts and group chats, the advisory said.

The agency suggested such counter-measures as not clicking suspicious links even if they come from known contacts and not entering one’s phone number on external sites claiming to be WhatsApp or Facebook.