Ghost Pairing' attack used in WhatsApp hacking : Your Account can be captured without a password

A new and very clever cyber attack has surfaced targeting WhatsApp users, called GhostPairing. This type of attack can gain full access to the account without stealing the user's password.

According to security researchers, this attack abuses WhatsApp's official device linking feature. The attack begins with a short message from an acquaintance. It usually says, 'Look, I found your photo!' and provides a link.

When the user clicks on the link, they are taken to a fake Facebook page, where they are asked to verify before viewing the photo. The user is then asked to enter their phone number.

When the user enters their mobile number, the attacker uses WhatsApp's 'Link Device' feature to send a 6-digit code to the user's phone. The user places the code on their WhatsApp as a security check, which adds the attacker's browser to the user's account as a 'Linked Device'.

Once the account is linked, the attacker can do many things without your knowledge. Such as reading all old and new messages, viewing and downloading personal photos, videos and voice notes, sending messages to others in your name, and deceiving more people, etc.

The reason this attack is dangerous is that your phone continues to work normally and you have no idea that someone else is using your account.ou can understand this attack as a thief making a fake key. Who does not break the door of your house, but rather tricks you into making an extra key for your house and takes advantage of the opportunity to sneak in when you are not there.

How to stay safe?

Experts have suggested users to adopt various security measures for this. First, go to WhatsApp Settings > Linked Devices and log out of any device or browser you don't recognize.

Do not click on external links that ask you to view photos or videos, even if they come from someone you know. Go to your WhatsApp settings and turn on two-step verification. This adds an extra layer of security to your account.

Never save any pairing or verification code sent by WhatsApp on any website or give it to anyone else.