How Do You Stop a GhostPairing WhatsApp Takeover in India?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

How does a GhostPairing takeover actually work?

The attacker persuades the victim to approve a device link. The mechanism is a pairing code, generated by WhatsApp when a new device is linked, which the victim reads out or types into a page the attacker controls. Once the code is submitted, the attacker's own device becomes a fully logged-in client of the account, with access to the chat history, the contacts and the ability to send messages as the victim. No password is needed, and no SIM swap is needed, which is why CERT-In rates the campaign High severity. What makes it work in India is the request pattern: the code is presented as a verification step, often during a fake support, delivery, job or KYC conversation, and the victim's instinct is to comply so the transaction continues. The defence is to treat any request to link a device as hostile until verified out of band.

What is the Statement of Account.zip malware and why is it worse?

It is a self-propagating campaign observed by I4C in 2026. The victim receives a .zip file over WhatsApp, SMS or email, named to look like an account statement or a regulatory communication, such as Statement of Account.zip, RBI.zip or MCA.zip. Extracting and opening it on Windows installs a Trojan via DLL sideloading, which hijacks the active WhatsApp Web session. The compromised account then automatically forwards the same lure to the victim's contacts, with a request to pass it to the company finance manager, so the malware spreads into corporate networks and escalates into the Boss Scam pattern SEBI cautioned on. I4C sent alerts to more than 58,000 potential victims in 30 days and protected over 10,000 Indians by geo-blocking command-and-control servers.

What controls actually prevent a WhatsApp takeover?

Six. Enable two-step verification with a device-locking PIN, which makes an unlinked device unable to pair without a code the attacker does not have. Review linked devices on a fixed schedule, monthly, and remove anything unfamiliar. Require that any request to link a device be verified out of band, never on the same channel. Keep the device itself clean: block unknown .exe and .dll execution from user profile directories, as CERT-In recommends, and use endpoint detection on the machine running WhatsApp Web, because the .zip campaign is a Windows malware problem. Do not install files from messaging threads, even from a contact you know, because the self-forwarding behaviour means the sender may be a friend whose device is already infected. And alert on unusual message volume, new device notices and sudden changes to profile details.

What should a business do if a staff account is taken over?

Eight steps, and the first two matter most. Unlink the unfamiliar device from the WhatsApp linked devices list, and change the account password and re-enable two-step verification. Warn the contacts immediately through another channel, because the compromised account will start sending lures, and a personal message from a colleague's known mobile number carries far more weight than a post on the compromised profile. Then treat the device as malware: preserve it for examination rather than wiping it, and check the Windows host for the DLL sideloading Trojan and any auto-forwarded messages to the finance team. Notify CERT-In through incident@cert-in.org.in if the incident touches a listed system, within 6 hours, and the 1800-11-4949 helpline for assistance. Report to cybercrime.gov.in or 1930 if money moved, and check whether the account sent lures to customers.

What are the common questions about W?