WhatsApp Web Hijacking: How to Check Linked Devices and Stay Safe

Most of us leave WhatsApp Web logged in on an office PC, a laptop or a friend’s computer and forget about it. Attackers are now using exactly that.

On 26 October 2026, Pakistan’s National Cyber Emergency Response Team (NCERT) issued a high-alert advisory about targeted phishing and malware attacks through WhatsApp Web, WhatsApp Desktop and email. Attackers pose as government officials and departments and send files that look like official documents. Opening them on a Windows computer can let the attacker control the device and steal passwords. The advisory also warns that a hijacked WhatsApp Web session lets someone send messages from your own number.

The advisory mainly mentions government staff and people who handle sensitive information, but the same tricks work on anyone.

How WhatsApp Web hijacking works

1. A “linked device” is added. Every WhatsApp Web or Desktop login is a linked device. If someone scans the QR code from your phone, or gets you to share a linking code, they get a full copy of your chats on their screen.
2. An “official” file arrives. A message or email that looks like it is from a ministry, department or office, with a notice, letter or circular attached. On Windows, opening it can install malware that takes over the computer, including your logged-in WhatsApp Web.
3. Your number is used against your contacts. The attacker reads your chats and messages your family, colleagues and groups as you: asking for money, codes, or sending the same infected file onward.

Your phone keeps working normally, so many people do not notice for days.

Warning signs

• A device you do not recognise in WhatsApp’s Linked devices list.
• Friends say they got strange messages or files “from you”.
• Messages appear as read that you never opened.
• Unexpected messages or files from a known contact, especially “urgent” official documents.
• You are asked to scan a QR code or share a code “to verify” something.

Check your linked devices now (30 seconds)

1. Open WhatsApp on your phone.
2. Android: tap the three dots (⋮) at the top, then Linked devices. iPhone: go to Settings, then Linked devices.
3. Look at every device and its last active time.
4. Tap any device you do not recognise and choose Log out. If in doubt, log out of all of them and link your own computer again.

Protect yourself

• Turn on two-step verification: Settings, Account, Two-step verification. Set a 6-digit PIN and add an email.
• Never share a code or scan a QR code that someone sends you. WhatsApp, PTA, banks and government offices never ask for it.
• Verify first. If a contact sends an unexpected file or a request for money, call them on their normal number before you open or pay anything.
• Log out after use on shared, office or café computers.
• Keep Windows, your browser and WhatsApp updated. Updates close the holes malware uses.
• Office computers: do not move WhatsApp files onto official Windows systems. Follow your IT department’s policy.
• Not sure about a message? Paste it into the Digital Guard Scam Checker.

If your WhatsApp is already hijacked

1. Log out of all linked devices from your phone right away.
2. If you opened a suspicious file on a computer, disconnect that computer from the internet and do not open the file again. Ask your IT team or a trusted technician to check it.
3. Turn on two-step verification and change the passwords you used on that computer (email, banking).
4. Tell your contacts and groups not to trust messages or requests “from you” for now.
5. Save evidence: screenshots, numbers, the file name and the time it arrived.
6. Report to NCCIA on helpline 1799 or at nccia.gov.pk.

Our Get Help guide explains what evidence to keep and how to file a complaint. Read also: the WhatsApp code scam.

Share this with your family and office groups. Thirty seconds of checking can stop someone using your name.