Lao Mao posted that he just fell for a phishing attempt. His phone received a message from a sender named WhatsApp, and the same number had sent a message in 2023. He judged that the official verification code had been used with that number, which was abandoned and then hijacked. The message claimed that the number was suspected of spamming and needed to be verified online within 30 minutes, or the account would be suspended.

The night before, he had just changed his WhatsApp to a Hong Kong number, and the official would send a notification to recent contacts about the change. Therefore, he interpreted the "spamming" as a system error and clicked on the short link in the message. The page guided him to the settings for linked devices, hiding the term "new device" and changing it to associate with a phone number and enter a verification code. After entering, a new authorized device appeared on the list. After thinking for about 30 seconds, he canceled the authorization and notified recent contacts.

He was unsure how much information was taken during those 30 seconds, believing that after canceling, the other party would find it difficult to continue messaging in his name, but files shared in the chat may have been partially leaked. If he had not canceled in time, the other party could have contacted all those who trusted him using his identity. He wrote about the experience as a cautionary tale, warning that similar tactics would reappear.

Public security research refers to this type of tactic as GhostPairing or device association phishing: it does not steal passwords but instead lures the victim into completing a legitimate device association for WhatsApp. Once the attacker gains access to the conversation, they can read recent chats, send messages, and copy the same script to the next contact. The main phone will not be logged out, and the only visible signal is often a strange terminal appearing in the linked device list.

WhatsApp later added pre-association warnings in some clients, marking suspicious locations and the permissions that the device would have. The incremental information is that the victim connected the "old official SMS channel being reused + psychological pressure from the number change notification + short link association code" into a complete phishing chain and completed the unlinking within half a minute.

In market mechanisms, this is social engineering driven by identity theft. The buying side is not in the public market but in the black market's demand for accessible conversations; the selling side is the user's contact list trust. The flow of funds goes to verification code receiving, phishing domains, and subsequent scam scripts. The beneficiaries are the attackers who gain access to the associated conversations; the pressured parties are the contact networks and users who have not checked the linked device list.

Source: Public Information