WhatsApp account takeovers often spread through contact lists: a message from someone you know leads you to a fake page, the page asks you to "verify" by entering a code in WhatsApp, and that code gives the attacker access to your account. Your contacts then receive the same message from you. If you use WhatsApp for work, a takeover also exposes customer and colleague conversations. You do not need to wait for an incident: the prevention steps below take about five minutes.
Summary for leaders
- Who is at risk: Anyone who uses WhatsApp, and more so people who use it for work, because the attacker can read chats and write to your contacts as you.
- What is the impact: Private chats and files are read, and messages go to your contacts in your name, including requests for money or more fake links.
- What to do this week: Turn on two-step verification, check linked devices, and never enter a code or scan a QR code because a message or website asked you to.
What happened
The best-documented case we found is GhostPairing. Security researchers at Gen Digital described it, and Security Affairs reported it on December 18, 2025, with activity seen in Czechia. We have not checked for newer reporting since, so treat it as an example of a broader pattern, not a measure of how common takeovers are today. Two older routes are also widely described in security guidance, including in Kaspersky's recovery guide, though we cite no source for specific figures on them.
1. A fake page that asks you to "verify" (device linking, as in GhostPairing). A trusted contact's hijacked account sends a message, for example claiming to have found your photo, with a link that looks like a Facebook preview. The link goes to a lookalike page that asks you to "verify" and shows a numeric code or QR code to enter in WhatsApp. Doing so links the attacker's browser to your account as a trusted device through WhatsApp Web. The attacker can then read your synced chats in real time, download files and message your contacts as you. Your phone keeps working normally, so you may not notice. No password theft and no SIM swap is needed: the attack uses a feature WhatsApp built.
2. Someone asks for your verification code. WhatsApp sends a one-time code by SMS or call when an account is registered on a new device. A scammer who triggers that code and then asks you to send it, often pretending to be a friend or a service, can register your number on their phone. Only scammers ask for this code or for your two-step verification PIN.
3. SIM swap. If an attacker persuades your mobile carrier to move your number to a new SIM, they receive your codes. Carrier protections vary by country.
What we do not know
- Gen Digital's report gives no victim count and names only Czechia. Whether the same kit is active in other countries, or how active it is now, is not established.
- The report does not say how the first accounts in the campaign were obtained.
- From the outside, a victim cannot tell which route was used to take over a given account. A message like the one the victim's contacts received can come from any of them.
- We have not read WhatsApp's Help Center in full. The timeframes below (about one week for a PIN reset, a couple of hours to three days for a restriction review) and the menu names reflect public guidance and may differ by phone, country and app version. Confirm them against WhatsApp's own Help Center.
Actions
Everything in these two tables is our own advice, drawn from public guidance. It is not a statement from WhatsApp.
Prevent it
| # | Ask your team to... | What done looks like |
|---|---|---|
| 1 | Turn on two-step verification: Settings > Account > Two-step verification. Choose a PIN they will remember and never share it | Two-step verification shows as on |
| 2 | Add a recovery email: Settings > Account > Email address. This lets a forgotten PIN be reset immediately; without it a reset takes longer | A recovery email is confirmed |
| 3 | Check linked devices: Settings (iPhone) or the three-dot menu (Android) > Linked devices. Log out anything they do not recognize, and check monthly | Only devices they recognize are listed |
| 4 | Never enter a code or scan a QR code because a message asked. Real WhatsApp linking is something you start yourself from your own phone's settings, never from a link in a chat | Staff can state the rule |
| 5 | Consider passkeys: Settings > Account > Passkeys. Login then needs a fingerprint or face. It is less convenient if you switch often between Android and iPhone | Passkey enabled, or a decision recorded not to |
| 6 | Ask their carrier about SIM swap protection: whether SIM changes can be blocked without a visit in person, and whether call forwarding is off | Carrier protection confirmed |
Also protect the email account used for recovery: a strong, unique password in a password manager, and two-factor authentication.
If your WhatsApp is already hacked: in this order
- Warn your contacts by another route. Call close contacts, or send a text or email: your account was taken over, ignore recent messages from you, do not click links, and do not send money. If you still have access, change your "About" line to a warning too.
- If WhatsApp says you are logged out, register again: enter your phone number, then the code sent by SMS or call. Restore your chats from a backup if offered. If it asks for a PIN you never set, go to step 3.
- If it asks for a PIN you never set, the attacker set it. Choose Forgot PIN. The reset link goes to the email on the account, which may be the attacker's rather than yours. Use the emailed link only if you set that email yourself. Otherwise request the reset and expect to wait, possibly about a week, during which you cannot use the account, then register again.
- Remove every linked device. Once WhatsApp opens, go to Linked devices, tap each device and choose Log Out. Do this even if registering again seemed to work, because we have not confirmed that it removes every linked session.
- Once you are back in, turn on two-step verification, add a recovery email, and check Linked devices again.
- Check your SIM. Contact your carrier, in person if you can, and ask whether a duplicate SIM was issued or call forwarding was set up.
- Change passwords you may have given away. If you typed a password into a fake page, change it on the real site and anywhere you reused it.
- If WhatsApp restricted your account because of spam the attacker sent, tap Request a review on the notice. Reviews can take from a couple of hours to a few days and cannot be rushed.
Be careful where you look for help. Scammers publish fake WhatsApp "support" phone numbers, and recovery does not involve phoning anyone. Use the in-app Help and WhatsApp's own Help Center.
For businesses
- Tell staff the three routes above and prevention step 4: nobody legitimate asks for a code, and linking a device is something you start yourself.
- Ask staff who use WhatsApp for work to turn on two-step verification and review linked devices this week.
- Agree in advance how a taken-over account is reported and how customers are warned, so the first hour is not spent deciding.
- Treat a message that asks for money or a change of bank details, even from a known number, as unconfirmed until checked by a call.
Technical details
- Device linking (GhostPairing): the lookalike page shows a pairing code or QR code that, once entered or scanned in WhatsApp, adds the attacker's browser as a linked device. The signal to look for is an unfamiliar entry under Linked devices.
- Account registration takeover: a sudden logout, an unexpected prompt for a verification code you did not request, or a PIN prompt you never set.
- Spam from your number: contacts report links or money requests from you that you did not send, or WhatsApp restricts the account.
No indicators of compromise (domains, hashes) are published here. We have not seen vendor-published ones for GhostPairing that we could verify.
Sources
- Security Affairs, December 18, 2025: GhostPairing campaign abuses WhatsApp device linking to hijack accounts (route 1, vendor-reported by Gen Digital)
- Kaspersky: What to do if your WhatsApp is hacked: a step-by-step guide (general recovery guidance, SIM swap and code scams)
- WhatsApp: Help Center (confirm menus and timeframes here)
Last reviewed: 2026-10-21. This advisory is based on public research and general guidance, and may change as more is learned. WhatsApp's menus, features and recovery rules can change; follow the Help Center if they differ.