vajiraoias

The Indian Computer Emergency Response Team (CERT-In) has issued a high-severity cybersecurity advisory warning users about a new and sophisticated cyber-attack method known as GhostPairing. Issued on 19 December 2025, the advisory highlights serious risks for WhatsApp users in India, as attackers can take over accounts without stealing passwords or performing SIM-swap fraud. GhostPairing exploits WhatsApp’s multi-device linking feature, which allows users to access their chats across browsers, laptops, and tablets. Cybercriminals manipulate victims into unknowingly linking an attacker’s device as a trusted one. Once this hidden device is paired, attackers gain full access to the WhatsApp account, including chats, media, and real-time messages. The attack typically begins with a social-engineering message sent from a trusted contact, such as “Hi, check this photo.” The message contains a malicious link with a convincing Facebook-style preview. Clicking the link redirects the victim to a fake content verification page, where they are tricked into entering their phone number and a pairing or verification code. This single step silently links the attacker’s device to the victim’s WhatsApp account. What makes GhostPairing especially dangerous is that it does not require passwords, OTP theft, or SIM swaps. Since victims themselves enter the pairing code, the attack is extremely difficult to detect. Once compromised, attackers can read old chats, receive new messages instantly, access photos, videos, and voice notes, impersonate the victim, and target contacts and groups for financial fraud, misinformation, and social-engineering scams. The advisory also comes in the backdrop of a Department of Telecommunications (DoT) directive mandating continuous SIM binding for messaging platforms like WhatsApp, Signal, and Telegram. Under this rule, linked devices may be logged out periodically, and users must re-link devices using QR codes to reduce account hijacking. However, digital rights advocates have raised concerns regarding privacy, usability, and technical challenges, especially for professionals relying on multi-device access. GhostPairing aligns with broader cybercrime trends in India, where the Indian Cybercrime Coordination Centre (I4C) has reported transnational scams using Facebook and Instagram ads to hijack WhatsApp accounts. CERT-In recommends avoiding suspicious links, never entering verification codes on external websites, regularly checking WhatsApp’s Linked Devices section, and immediately logging out unknown devices. Organisations are advised to strengthen cybersecurity awareness, deploy mobile device management (MDM) policies, and establish rapid incident-response protocols. Overall, the GhostPairing attack highlights the evolving sophistication of cyber threats and reinforces the importance of user awareness, platform security, and strong cybersecurity governance in India. 👉 Join Our WhatsApp Channel- https://www.whatsapp.com/channel/0029VaaGAqPCxoAugdgpyH41 For any Query- Call Now: 📞 8988885050 or 8988886060 Email: 📩 info@vajiraoinstitute.com 🌐 Visit: www.vajiraoinstitute.com Registration is Now Open for both online and offline batches in 2025. Hurry up, limited seats. 📌 Follow us on Social Media: Facebook - https://www.facebook.com/vajiraoinstitute/ Twitter - https://x.com/vajiraoandreddy LinkedIn - https://www.linkedin.com/school/vajirao-and-reddy-institute-delhi Pinterest - https://in.pinterest.com/vajiraoandreddyinstitute #GhostPairing #CERTIn #CyberSecurity #WhatsAppScam #DigitalSafety #CyberCrimeIndia #AccountHijacking #SIMBinding #SocialEngineering #UPSCCurrentAffairs