MeitY Warns of ‘GhostPairing’ Cyber Campaign Targeting WhatsApp Accounts

Ghost pairing, a recent danger to WhatsApp, is subtly jeopardising user privacy. Scammers use phoney QR codes or verification codes to fool people into connecting their accounts. This enables real-time chat viewing by attackers without the victim's awareness. To avoid data exploitation and privacy violations, users must be watchful, often monitor connected devices, and never divulge sensitive codes.

WhatsApp has evolved into a user's "go-to" tool for communication in both personal and business contexts. Children who use the app to join in school groups and talk with pals are likely to know its green-white interface, which is combined with a variety of functions and generative Meta AI. However, as the platform's popularity continues to rise, fraudsters' tactics take advantage of familiarity and trust. Ghost pairing on WhatsApp is one such new danger.

Modus Operandi of Ghost Pairing

The "Linked Devices" feature is used in WhatsApp ghost pairing. Scammers typically utilise phoney communications posing as support or known contacts to deceive users into sharing a verification code or scanning a QR code. Once connected, the victim's WhatsApp and the attacker's device sync covertly. Unaware that messages, media, and occasionally even contacts are being duplicated in another undesired device, the victim carries on conversing as usual. Because there are so few outward indicators of ghost pairing, it can be risky. There isn't an unexpected app crash or logout.

Chats and notifications function regularly, so the user is never left wondering what harmful activity may be going on behind their suspicions. Because many consumers don't check their connected devices very often, attackers have extended access. Because the couple exploits a genuine WhatsApp feature, victims frequently don't recognise something is amiss until after fraud, data misuse, or private conversations are disclosed.

How Scammers Entice Users

Scammers post urgent situations, relying primarily on human psychology. By alleging problems with account verification, job offers, or urgent demands from "friends," they invent a need. Hackers may even pose as HR departments or WhatsApp representatives. The intention is to force users to take immediate action without allowing them much time to think things through. The devices then sync when the user scans the code and has faith in the situation.

The first step in prevention is awareness. Never scan someone else's QR code or exchange WhatsApp verification codes. Check the "Linked Devices" area frequently, and take out any devices that appear suspicious or problematic. For further security, enable two-step verification. Above all, statements that instill a sense of urgency or terror must be reconsidered. Weeks of harm and privacy loss can be avoided with a few seconds of cross-checking and verification.