How do I know if my WhatsApp has been hacked?
Key takeaways
- Settings, then Linked Devices, is a two-minute check and the single most informative screen on the platform for a suspected takeover.
- GhostPairing adds a trusted browser session using only a phone number, with no password and no SIM swap, so no other signal will warn you first.
- CERT-In rates the GhostPairing WhatsApp takeover campaign as High severity, so treat any unknown linked device as real.
- Two-step verification with a PIN, not an SMS code, is what stops a future pairing attempt from succeeding silently.
- The malware campaign that matters most in 2026 spreads through the victim's own contacts, so a compromised account harms your contacts even if nothing was stolen from you.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What is the two-minute linked-device check?
Open WhatsApp, tap the three-dot menu, go to Settings, then Linked Devices. You will see every browser, desktop or tablet session linked to your number, with an approximate location and last-active time. Log out anything you do not recognise, and log out anything you cannot explain even if it looks familiar, because a reinstall on the attacker's own machine produces an innocuous name. Then go back to Settings, Account, and Two-step verification, and set a six-digit PIN if one is not set. If you cannot set a PIN because the account asks for the current one, your account has been taken over and the PIN is being used against you.
What are the signs my WhatsApp is already compromised?
Six signs. Messages in your chat list that you did not send. A changed profile picture or About section, which is the classic fingerprint of a new operator. Contacts telling you that you sent them a link, a payment request or a code. Your account joining groups you never asked to join, often crypto or job groups. Requests for OTP or a six-digit code arriving as if from a stranger, which is the attacker pairing their own device. And a 'This account was migrated to a new device' banner you do not recognise. If two or more of these are true, treat the account as fully compromised and rebuild it, not just clean it.
How does the GhostPairing attack actually work?
GhostPairing works on the pairing-code flow that WhatsApp uses to link a new device. The attacker obtains your phone number, then tricks you into entering a pairing code, or into scanning a QR code, on a browser you do not recognise as theirs. Because the pairing code is a valid authorisation, WhatsApp treats the attacker's browser as a trusted device. No password is required, no SIM swap is needed, and because the account now legitimately holds a second device, many people assume the login history is normal. CERT-In has rated the campaign High severity. The prevention is a PIN, because a linked device cannot be added without the six-digit code, and the detection is the linked-devices list.
How do I stop it propagating to my contacts?
Speed and honesty. Log out the unknown session and change the two-step PIN immediately, because that cuts the attacker's access. Warn your contacts in the groups you are in, and privately to anyone who received an odd message from you, using a different channel than WhatsApp so the attacker cannot see the warning. Ask them not to click any link you sent and not to share any code. Report the account in-app. If the campaign involved a file such as 'Statement of Account.zip' or 'RBI.zip', tell your contacts not to extract it on a Windows machine, because that malware family hijacks an active WhatsApp Web session and re-forwards itself to your contacts.
| Indicator | What it indicates | Correct response |
|---|---|---|
| Unknown browser in Linked Devices | GhostPairing or stolen-device takeover | Log out, set a two-step PIN, change linked-account sessions |
| Messages you did not send | Account under attacker control | Log out everything, re-verify account, report in-app |
| Profile picture or About changed | New operator rebranding the account | Revert, log out sessions, set a PIN |
| Contacts report odd links or payment requests | Outbound fraud from your account | Warn contacts off-platform, report, preserve chats |
| Account added to unknown groups | Attacker monetising the account | Leave the groups, log out sessions, report |
| Requests for an OTP or pairing code | Live device-linking attempt | Never share the code, log out linked devices now |
What are the frequently asked questions?
Get a straight answer on this
Send us the WhatsApp symptoms you have seen, and we will return a fixed-price account-takeover review covering linked sessions and recovery settings.
Send us the details See pricing