WhatsApp takeover via device-linking pairing codes, which CERT-In rates High severity: how it works, the self-forwarding malware, and the controls that stop it.
GhostPairing is a WhatsApp account takeover campaign that uses device-linking pairing codes, so the attacker needs neither the password nor a SIM swap, and CERT-In rates it High severity. The mechanism is a social engineering of the victim's linked devices screen, and a second 2026 vector is a self-propagating .zip containing an .exe and a .dll that hijacks the active WhatsApp Web session and forwards itself to the victim's contacts. The I4C sent SMS alerts under header I4CMHA-G to more than 58,000 potential victims in 30 days, and over 10,000 Indians were protected through geo-blocking of command-and-control servers.
The attacker persuades the victim to approve a device link. The mechanism is a pairing code, generated by WhatsApp when a new device is linked, which the victim reads out or types into a page the attacker controls. Once the code is submitted, the attacker's own device becomes a fully logged-in client of the account, with access to the chat history, the contacts and the ability to send messages as the victim. No password is needed, and no SIM swap is needed, which is why CERT-In rates the campaign High severity. What makes it work in India is the request pattern: the code is presented as a verification step, often during a fake support, delivery, job or KYC conversation, and the victim's instinct is to comply so the transaction continues. The defence is to treat any request to link a device as hostile until verified out of band.
It is a self-propagating campaign observed by I4C in 2026. The victim receives a .zip file over WhatsApp, SMS or email, named to look like an account statement or a regulatory communication, such as Statement of Account.zip, RBI.zip or MCA.zip. Extracting and opening it on Windows installs a Trojan via DLL sideloading, which hijacks the active WhatsApp Web session. The compromised account then automatically forwards the same lure to the victim's contacts, with a request to pass it to the company finance manager, so the malware spreads into corporate networks and escalates into the Boss Scam pattern SEBI cautioned on. I4C sent alerts to more than 58,000 potential victims in 30 days and protected over 10,000 Indians by geo-blocking command-and-control servers.
Six. Enable two-step verification with a device-locking PIN, which makes an unlinked device unable to pair without a code the attacker does not have. Review linked devices on a fixed schedule, monthly, and remove anything unfamiliar. Require that any request to link a device be verified out of band, never on the same channel. Keep the device itself clean: block unknown .exe and .dll execution from user profile directories, as CERT-In recommends, and use endpoint detection on the machine running WhatsApp Web, because the .zip campaign is a Windows malware problem. Do not install files from messaging threads, even from a contact you know, because the self-forwarding behaviour means the sender may be a friend whose device is already infected. And alert on unusual message volume, new device notices and sudden changes to profile details.
Eight steps, and the first two matter most. Unlink the unfamiliar device from the WhatsApp linked devices list, and change the account password and re-enable two-step verification. Warn the contacts immediately through another channel, because the compromised account will start sending lures, and a personal message from a colleague's known mobile number carries far more weight than a post on the compromised profile. Then treat the device as malware: preserve it for examination rather than wiping it, and check the Windows host for the DLL sideloading Trojan and any auto-forwarded messages to the finance team. Notify CERT-In through incident@cert-in.org.in if the incident touches a listed system, within 6 hours, and the 1800-11-4949 helpline for assistance. Report to cybercrime.gov.in or 1930 if money moved, and check whether the account sent lures to customers.
| Vector | Mechanism | Primary control |
|---|---|---|
| GhostPairing | Device-linking pairing code shared with attacker | Two-step PIN and monthly linked-device review |
| Statement of Account.zip | DLL sideloading Trojan hijacks WhatsApp Web | Block unknown .exe and .dll; EDR on the host |
| SIM swap | Number moved to an attacker device | Number-transfer lock and SIM swap alerts |
| Malicious links | Fake delivery, job or KYC message | Link policy and staff reporting habit |
GhostPairing is a WhatsApp account takeover campaign that uses device-linking pairing codes, so the attacker needs neither the password nor a SIM swap, and CERT-In rates it High severity. The mechanism is a social engineering of the victim's linked devices screen, and a second 2026 vector is a self-propagating .zip containing an .exe and a .dll that hijacks the active WhatsApp Web session and forwards itself to the victim's contacts. The I4C sent SMS alerts under header I4CMHA-G to more than 58,000 potential victims in 30 days, and over 10,000 Indians were protected through geo-blocking of command-and-control servers.
A WhatsApp account takeover campaign in which the attacker convinces the victim to approve a device-linking pairing code, which makes the attacker's device a fully logged-in client. CERT-In rates the campaign as High severity, and it requires neither the account password nor a SIM swap.
No, though both target WhatsApp. The .zip campaign is Windows malware delivered by DLL sideloading that hijacks the active WhatsApp Web session and then forwards itself to the victim's contacts. GhostPairing is a pure account-linking attack that needs no malware at all.
Look for a new device in the linked devices list, unexpected verification prompts, unfamiliar message activity, a changed profile picture or bio, contacts reporting strange messages, and missing chat history. Review the linked devices list first, because it is where the attacker is visible.
Unlink the unfamiliar device, reset the password and re-enable two-step verification, warn contacts through another channel, and treat the device as malware to be preserved for examination. If a listed system is involved, report to incident@cert-in.org.in within 6 hours, and report financial fraud on cybercrime.gov.in or the 1930 helpline.
Yes. AAVETech runs fixed-price social media account security and messaging takeover testing at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days with a written report and a retest after your remediation.
Read the full guide on AAVETech: How Do You Stop a GhostPairing WhatsApp Takeover in India?.
Send us the WhatsApp and messaging accounts your staff use, and we will return a fixed-price takeover readiness assessment with a written scope.
Talk to an analyst about this.