WhatsApp GhostPairing: how to recognise and prevent unwanted access

This is a lasting safety guide about a documented abuse of WhatsApp’s legitimate device-linking feature. Gen Digital described the GhostPairing campaign on 15 December 2025. We are not claiming every similar lure is brand-new—treat unexpected “verify to see a photo” requests as high risk whenever they appear.

The attack does not prove WhatsApp’s end-to-end encryption was broken. Attackers persuade you to invite their device in as a linked session.

GhostPairing is social engineering around WhatsApp’s real “link a device” flow (WhatsApp Web / Desktop). Scammers mislead you into adding the attacker’s browser or computer as a linked device on your account.

Typical path: you receive a short message—often from a compromised contact—claiming they found a photo or similar. The link opens a fake page that mimics a familiar brand and asks you to “verify” before viewing. The page may show a WhatsApp pairing code or a QR code. Entering that code or scanning that QR in WhatsApp can approve the attacker’s session.

Do not confuse a WhatsApp device pairing code with an SMS registration code. A pairing code is used to link WhatsApp Web or Desktop. An SMS code is for registering or verifying your phone number when setting up WhatsApp. GhostPairing abuses pairing—not SMS registration.

Both misleading pairing codes and QR codes can be used. Numeric pairing codes are often easier for scammers because everything can happen on one phone.

Only opening a link is not the same as linking a device. Closing the page without entering a code or approving a link reduces risk. Still, never assume a page is harmless—and never treat “I only opened it” as a guarantee that nothing happened if you also typed a number, scanned a QR, or confirmed a prompt in WhatsApp.

After a device is linked, you can often keep using WhatsApp on your phone while the attacker reads synced chats and media (within what WhatsApp syncs to linked devices) and can send messages as you. The unwanted device can appear in Linked devices and can be logged out from there—it is not described as permanently invisible.

Logging out an unknown device stops further access through that session. It does not erase chats or files the attacker already viewed or copied.

A. I only received a suspicious message

• Do not open the link.
• Confirm with the sender through another trusted channel (call or meet them) before trusting any “photo” claim.
• Report or block the message in WhatsApp where appropriate.

B. I clicked the link

• Close the page.
• Do not enter pairing codes and do not approve any device link in WhatsApp.
• If you are unsure what you confirmed, check Linked devices now (see the section above).
• If you also entered passwords, payment details, downloaded a file, or granted other permissions, take extra steps: change those passwords, watch bank/accounts, and remove unknown apps.

C. I entered a code or scanned a QR code

• Immediately open Linked devices and log out every unknown session.
• Warn contacts if messages may have been sent as you.
• If you can no longer access WhatsApp, follow official WhatsApp Help Center recovery guidance—not instructions from chats.
• Remember: logging out stops that linked session going forward; it cannot recall data already seen or copied.

Enable WhatsApp two-step verification as extra account protection. It is useful hygiene, but it does not by itself prevent GhostPairing or automatically end an already linked device—you still need to review Linked devices.

1. Never link WhatsApp because a webpage asks you to “verify” to view a photo or file.
2. Start device linking only from inside WhatsApp when you intentionally open WhatsApp Web or Desktop.
3. Periodically review Linked devices and remove unknowns.
4. Be cautious with unexpected links even from known contacts—their account may be compromised.

You can paste a suspicious website URL into Fraudly’s website checker to assess risk signals before you interact further. That can help when you are unsure about a lure page.

Fraudly does not detect every phishing page or every GhostPairing attempt. A favourable scan is never a reason to approve an unexpected WhatsApp device link.

Fraudly cannot view or manage your WhatsApp linked devices. Always use the official WhatsApp app and Help Center for account recovery.

Documented attack technique: Gen Digital research article “GhostPairing Attacks: from phone number to full access in WhatsApp” (published 15 December 2025) — gendigital.com/blog/insights/research/ghostpairing-whatsapp-attack.

Official product steps: WhatsApp Help Center — “How to unlink a device” and related Linked devices / account security articles on faq.whatsapp.com. Menu labels above follow WhatsApp’s documented iPhone and Android paths; wording can differ by version.

General prevention tips on this page are practical hygiene based on those sources. We do not invent victim counts, active campaigns beyond what Gen Digital documented, or Fraudly detection rates for this attack.