New Delhi: There is a new WhatsApp scam that is causing concern following the discovery of an approach by cybersecurity experts that enables attackers
to gain control of users without stealing passwords, SIM cards, or one-time authentication codes. The operation is referred to as GhostPairing, which exploits a legal WhatsApp device-linking option and does not exploit any technical weaknesses at all but instead is fully based on social engineering.
Rather than intruding into the app, hackers deceive users into accepting a malicious device on their own. After gaining admission, hackers will be able to read conversations, get real-time messages, download files, and send messages to the contacts when the phone is still operating normally. This will ensure the attack is hard to detect and spreads quickly via the trusted networks.
How the Ghost Pairing scam works
A report by a cybersecurity company, Gen Digital, indicates that the attack usually starts with a friendly message by a familiar person, like, “Hey, I just found your photo!” The message has a link that is displayed in the form of a Facebook-like preview within WhatsApp, therefore, looking authentic.
The link takes you to a counterfeit website which displays the appearance of a Facebook photo viewer. The page requests users to verify in order to view the content. This measure does not revolve around Facebook. Rather, it actually triggers an official device-pairing procedure in WhatsApp.
Victims approve the hack themselves
Users are then asked to provide their phone number, after which WhatsApp will create a numeric pairing key. The counterfeit site then asks them to insert this code in WhatsApp, claiming it is a standard security measure.
In such a way, the victims unwillingly accept the attacker as a signed-in browser as a connected device. This will provide the hacker with complete WhatsApp Web access. Messages, calls, and media are all end-to-end encrypted; however, the attacker is able to view everything since he or she is logged in as a user.
Why the attack is hard to detect
It was observed that GhostPairing does not decrypt encryption or use software bugs. It is effective since users have faith in the source of the message and fail to understand the process of device linking. The connected devices are not easily removed, which gives an opportunity to stay connected to the attacker over an extended period of time.
The campaign was initially noticed in Czechia, yet Gen Digital advised it was simple to spread the virus to areas. The same lure is sent out on compromised accounts to contacts and group chats to assist the scam in spreading into existing trust networks rather than spamming in large volumes.
How users can protect themselves
Security experts suggest that one should verify Settings>Linked Devices in WhatsApp frequently and delete any unknown sessions. Any demand to scan QR codes or insert pairing numbers on websites should be regarded as suspicious by the users.
By turning on two-step verification, delaying the action before clicking on an unexpected link, and verifying suspicious messages, including those by familiar people, it can be decreased. According to the researchers, the fraud indicates the level of vulnerability of the device-pairing systems and the need to be more alert and implement more effective restrictions that could stop the abuse.
