A new campaign ‘hacks’ WhatsApp accounts without stealing passwords or duplicating the SIM

A new campaign manages to get hold of it control of WhatsApp accounts through an attack called ‘GhostPairing’, in which the user himself makes the fraudulent link with a browser controlled by the cybercriminal.

‘GhostPairing’ begins with a message that the victim receives from one of their contacts. In it he informs you that he has found a photograph in which it appears and shares a link so you can check it out.

This link opens a login page that imitates that of Facebook, in which you are asked to enter your phone number and then asked to scan a QR code with the WhatsApp application or enter a numerical code to confirm registration, the latter method being much more common.

What these steps do is guide the victim through the device pairing process of the messaging application that, legitimately, allows you to join the main account on up to four devices and access it without having to use the main smartphone.

Precisely, linking by telephone number is available to the customer of WhatsApp for Windows or WhatsApp Web. In this campaign, a cybercriminal abuses this legitimate tool to take control of the user’s account in the browser.

In this way, the cybercriminal can open WhatsApp Web in his browser, although in the eyes of WhatsApp itself it was the victim who linked a new device, although he did not realize it. Hence the name of the attack, ‘GhostPairing’ or phantom pairing, as the Gen Digital researchers explain.

By having access to the account, the cybercriminal accesses the same functions that any user can have on WhatsApp Web: conversation history, receiving messages in real time, downloading documents and multimedia filesetc.

You can also send messagestaking advantage of the victim’s contact list. This is how the cybercriminal initially contacted the victim with the message in the photograph. All this without stealing access credentials or making a fraudulent duplicate of the SIM card.