Can you test our WhatsApp Business and social media accounts for takeover?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What does a social and messaging account takeover audit cover?

Six areas, checked against how these platforms actually fail rather than against a generic checklist. Linked devices and active sessions on WhatsApp Business, Instagram, Facebook, Google and LinkedIn, with every unknown device logged out and the session list cleared. Account recovery configuration, because the recovery email and the recovery phone are the actual attack surface when a device is lost. One-time password delivery settings, including whether SMS is the only channel or whether an authenticator app is available. Third-party and OAuth application consents, since an authorised malicious app is a permanent invisible observer of the account. Multi-factor authentication state, specifically whether two-step verification on WhatsApp uses a PIN rather than SMS. And a staff susceptibility measurement.

How does the GhostPairing attack actually work?

The GhostPairing campaign, which CERT-In rates as High severity, targets WhatsApp through a technique that removes two of the controls people assume are protecting them. The attacker does not need your password, and does not need a SIM swap. Instead they persuade the target, through a call, a message or a phishing page, to enter a pairing code that authorises the attacker's browser or device as a linked, trusted device. From that point the attacker can read the account, send messages as the victim and, critically, receive the messages sent to it, which is how a compromised business account becomes a trusted delivery channel for the next victim. The defensive control is specific: two-step verification with a PIN, and treating any request for a pairing code as a compromise in progress.

How do you measure staff susceptibility safely?

With a simulated campaign that is announced, bounded and scored, rather than a real phishing site that harvests credentials. The standard method is a short message or email that mimics the lure, such as a fake Statement of Account.zip attachment or a fake pairing-code request, sent to a defined group of staff, with a landing page that captures the click without collecting real credentials, and with clicks scored afterwards in a session that is explicitly non-punitive. The result is a percentage, and that percentage is the number that predicts your real exposure. The related campaigns are real: the Statement of Account.zip and RBI.zip malware both arrive over WhatsApp, and CERT-In's GhostPairing advisory makes the pairing-code lure the one to test for.

What do we fix once the audit is done?

Six specific changes, all of which are quick. Enable two-step verification with a PIN on every WhatsApp account, including the business number, and never rely on SMS alone. Remove every unknown linked device and revoke active sessions, then repeat that on a schedule. Set a strong, unique account recovery email and phone that are not on the same domain as the main account, since a compromised domain account should not be able to reset a social account. Remove every third-party app you do not actively use. Document a rule that no employee of any rank ever approves a pairing code or a remote-access request, and train on it. And require a hardware security key or an authenticator app for any account that can move money or speak as the company.

What are the frequently asked questions?