A shocking new hack for WhatsApp takes control of accounts without passwords
Cybersecurity experts warn of a new wave of dangerous cyberattacks targeting WhatsApp users, which allow hackers to gain full control over accounts without the need for passwords or breaching end-to-end encryption, according to Gen Digital.
These attacks rely on a method known as "hidden pairing," which exploits the official "linked devices" feature in WhatsApp. This feature allows users to access the same account on multiple devices by scanning a QR code, and it was originally designed to facilitate usage.
Security experts say that hackers deceive victims into linking the attacker's device to their WhatsApp account without their knowledge. Once linked, the attacker gains full access to messages and can send new messages without the user noticing.
Recently, a noticeable increase in these attacks has been recorded within the Czech Republic, but experts warn of their easy spread to other countries. This type of attack relies on psychological deception rather than automated hacking, as a single wrong step from the victim is enough.
Victims often receive phishing messages containing links that look like login pages for Facebook, photo galleries, or familiar digital services. Users are asked to scan a QR code or enter their phone number and verification code, effectively linking the hacker's device to their WhatsApp account.
After the linking process is successful, the attacker can read conversations and impersonate the victim. The danger of the attack increases because subsequent phishing messages often come from accounts of friends or family members who have been previously hacked, which enhances the element of trust.
Gen Digital experts advise users to review their WhatsApp settings and go to the 'Linked Devices' section to ensure there are no unknown devices, and to unlink them immediately. While this step stops future activity, previous messages may have been accessed.
It is also advised to inform contacts through other means than WhatsApp in case of suspected hacking, in addition to enabling two-factor authentication to enhance security. Experts noted that similar methods were previously used to hack the Signal app by Russian hacking groups.
The report concludes that messaging app companies are required to take stronger technical measures, such as providing clearer warnings to users, displaying the type of device and geographic location during the connection process, and limiting the number of connection attempts within short time frames to mitigate this rising threat.