Law enforcement agencies are issuing urgent warnings regarding a sophisticated WhatsApp scam known as “ghost-pairing,” which allows cybercriminals to hijack active accounts without triggering immediate security alerts. According to warnings issued by the police in Düren, Germany, the fraudulent scheme relies on social engineering tactics and deceptive voting requests to compromise user devices.
The Dance Contest Trap
The attack typically begins with a seemingly innocent message sent from a compromised account belonging to a trusted friend or acquaintance. Victims receive requests asking for support in an online poll, such as voting for a child named Eliska in a dance competition. The message often claims the contest is urgent and offers a prize like a free dance class.
The QR Code Trap
Once the recipient engages with the message, the attackers direct them to follow a malicious link or scan an unknown QR code. These actions prompt the victim to confirm a device linkage on their smartphone. By approving this prompt, the user unknowingly links their personal WhatsApp account directly to a device controlled by the threat actors.
Silent Backend Access
Following a successful ghost-pairing attack, WhatsApp continues to function normally on the victim’s primary smartphone, masking the ongoing security breach. However, unauthorized actors gain full or partial backend access to the account. According to police advisories, attackers can read private messages, delete conversations, and send fraudulent requests to the victim’s saved contacts.
How to Detect and Prevent WhatsApp Ghost-Pairing
Defending against ghost-pairing requires strict digital hygiene and regular account audits. Security experts and law enforcement recommend avoiding unverified links and unsolicited QR codes entirely, even if they appear to originate from known contacts.
Users should never confirm device linkage prompts unless they initiated the setup process themselves. When contacts send unexpected requests for money, emergency assistance, or validation codes, recipients should verify their identity through an alternative communication channel, such as a direct phone call.
Account holders can verify their current security status directly within the application. By navigating to Settings, selecting Profile, and opening the “Linked Devices” menu, users can review every active session connected to their account. Any unfamiliar device listed in this menu should be disconnected immediately.
Reporting Financial and Data Breaches
Victims who experience financial loss or identity compromise as a result of a ghost-pairing attack must contact local law enforcement immediately to file a formal report.
Related reading