Lao Mao Falls for WhatsApp Device Phishing
Lao Mao posted that he just fell for a phishing attempt. His phone received a message from a sender named WhatsApp, and the same number had sent a message in 2023. He judged that the official verification code had been used with that number, which was abandoned and then hijacked. The message claimed that the number was suspected of spamming and needed to be verified online within 30 minutes, or the account would be suspended.
The night before, he had just changed his WhatsApp to a Hong Kong number, and the official would send a notification to recent contacts about the change. Therefore, he interpreted the "spamming" as a system error and clicked on the short link in the message. The page guided him to the settings for linked devices, hiding the term "new device" and changing it to associate with a phone number and enter a verification code. After entering, a new authorized device appeared on the list. After thinking for about 30 seconds, he canceled the authorization and notified recent contacts.
He was unsure how much information was taken during those 30 seconds, believing that after canceling, the other party would find it difficult to continue messaging in his name, but files shared in the chat may have been partially leaked. If he had not canceled in time, the other party could have contacted all those who trusted him using his identity. He wrote about the experience as a cautionary tale, warning that similar tactics would reappear.
Public security research refers to this type of tactic as GhostPairing or device association phishing: it does not steal passwords but instead lures the victim into completing a legitimate device association for WhatsApp. Once the attacker gains access to the conversation, they can read recent chats, send messages, and copy the same script to the next contact. The main phone will not be logged out, and the only visible signal is often a strange terminal appearing in the linked device list.
WhatsApp later added pre-association warnings in some clients, marking suspicious locations and the permissions that the device would have. The incremental information is that the victim connected the "old official SMS channel being reused + psychological pressure from the number change notification + short link association code" into a complete phishing chain and completed the unlinking within half a minute.
In market mechanisms, this is social engineering driven by identity theft. The buying side is not in the public market but in the black market's demand for accessible conversations; the selling side is the user's contact list trust. The flow of funds goes to verification code receiving, phishing domains, and subsequent scam scripts. The beneficiaries are the attackers who gain access to the associated conversations; the pressured parties are the contact networks and users who have not checked the linked device list.
Source: Public Information
ABAB AI Insight
This phishing attempt occurred during a number change window. The official had just sent a mass notification to contacts about the "number change," and the victim also thought the system might have misjudged the spamming, thus treating the short link as a customer service entry. The attacker does not need a new system vulnerability; they only need an old SMS channel that still displays the WhatsApp name and embed the legitimate "associate device with number" process into the verification page. The extra device in those 30 seconds is the complete conversation.
The capital path on the black market side is clear: first occupy the abandoned sending number, then send bulk countdown messages for account suspension, and finally convert the association code into a transferable identity. The goal is not a one-time account theft display but to enter the trust chain, using a familiar name to ask the next target for money or another verification code. Number changes, short links, and hiding the "new" word are all materials to reduce friction.
In a similar context, this is the same type of product abuse as Signal device phishing and voting link scams on WhatsApp Web, not traditional SMS trojans. The industry phase is that instant messaging has made multi-device convenience a default capability, shifting the attack surface from passwords to pairing codes that users confirm themselves. Whoever gets users to complete the official process in panic first will gain plaintext conversations in the encrypted channel.
The structural change belongs to the reverse utilization of technical substitution. End-to-end encryption protects the channel but does not audit whether you authorized a second device to a stranger. The mechanism is: the convenience feature changes the "verification code" from a login key to a pairing consent; once consent occurs, encryption actually protects the content read by the attacker until the device owner clicks cancel in the list.
ABAB News · Cognitive Laws
Once the official channel is abandoned, it will become a scammer's sending header.
Once the verification code is used for device association, it is no longer just for login.
The gap in the trust chain opens at the step where the user confirms with their own click.