WHATSAPP DEVICE LINKING ABUSED IN ACCOUNT HIJACKING ATTACKS

Summary from the TLDR InfoSec newsletter

Gen Digital researchers have uncovered a new phishing campaign, which they dubbed GhostPairing, that abuses the device-linking feature of WhatsApp to hijack accounts. The victims are contacted by a known contact that shares a link allegedly leading to an online photo of a victim, which leads to a fake Facebook site that requests the user to initiate a device-linking process to log in. Attackers can then use the victim's account to forward the initial lure and propagate.