A new wave of WhatsApp scams is making the rounds, and this time, cybercriminals are exploiting the app's Linked Devices feature to seize control of user accounts. The attack, recently highlighted by Infosecurity Magazine, marks a worrying shift in tactics that could affect millions of daily active users. If you use WhatsApp on multiple devices, understanding this threat is no longer optional—it's essential.

How the Scam Works: The Linked Devices Trap

The scam revolves around a feature designed for convenience: linking WhatsApp to additional devices like a desktop or tablet. Attackers trick victims into scanning a malicious QR code or clicking a fraudulent link that mimics WhatsApp's official pairing process. Once the victim scans the code, the attacker's device becomes linked to the victim's account, granting full access to chats, media, and contacts.

This method is particularly insidious because it bypasses traditional two-factor authentication. The victim never shares a code or password—they simply scan what looks like a legitimate QR code. In many cases, the attack is initiated through a phishing message that claims the user's account is compromised and urges them to re-verify their device.

Why the Linked Devices Feature Is a Prime Target

The feature allows up to four linked devices to operate simultaneously without needing the primary phone to stay online. That convenience, however, creates a blind spot. Many users assume that if they don't share a password, they're safe. Attackers exploit this assumption, using social engineering to push victims into confirming a device link they never intended to authorize.

  • Social engineering: Scammers impersonate support agents or friends to build trust.
  • QR code phishing: Fake login pages are designed to look identical to WhatsApp's official interface.
  • Lack of visibility: Many users rarely check their list of linked devices, allowing attackers to remain hidden for days.

Immediate Steps to Protect Your Account

If you suspect your WhatsApp account has been hijacked, act fast. The first step is to open WhatsApp on your primary phone, navigate to Settings > Linked Devices, and review all active sessions. Any device you don't recognize should be logged out immediately. This action disconnects the attacker and prevents further access.

Next, enable two-step verification if you haven't already. This adds an extra PIN that must be entered when registering your phone number with WhatsApp, making it harder for hijackers to take over your account even if they have your device linked. It's a simple setting that adds a critical layer of defense.

What to Do If You've Been Hacked

If you can no longer access your account, you'll need to reclaim it by re-registering your phone number within WhatsApp. The app will send a one-time verification code via SMS. Once you enter it, WhatsApp will automatically log out all other linked devices. You can then re-link your own devices and reset your two-step verification PIN if needed.

After regaining control, it's wise to inform your contacts that your account was compromised. Attackers often use hijacked accounts to spread phishing links or request money from friends and family. A quick warning can prevent your network from falling victim to the same scam.

Broader Implications for Messaging Security

This scam highlights a growing trend in cybercrime: attackers are moving away from brute-force hacking and toward exploiting legitimate features through social engineering. The Linked Devices feature is just one example. Similar tactics have been observed in other messaging platforms, where multi-device support becomes a vector for account takeover.

For everyday users, the key takeaway is to treat any unsolicited request to scan a QR code or click a link with suspicion—even if it appears to come from a trusted contact. Always verify the source through an independent channel, such as a phone call, before taking action.

Key Takeaways

  • Always review your WhatsApp Linked Devices list regularly and log out unknown sessions.
  • Enable two-step verification to add an extra PIN layer to your account.
  • Never scan QR codes or click links from unsolicited messages, even if they appear to be from friends.
  • If hacked, re-register your number to force-logout all devices and reset security settings.
  • Warn your contacts immediately to prevent the scam from spreading through your network.

As messaging apps become more integrated into our daily lives, security must evolve alongside convenience. Staying one step ahead of scammers means understanding the features you use—and knowing how they can be turned against you.