I looked at a WhatsApp Web phishing sample that tried to get people to scan a QR code on a fake page. The goal was not to “break” WhatsApp’s encryption. It was to trick someone into authorizing an attacker’s browser as a linked device.
What I observed
In the sample I examined, the QR code on the phishing page refreshed over time. A single screenshot could therefore miss changes in the code.
How the abuse works (high level)
WhatsApp Web / multi-device linking lets a phone authorize another client. Meta has described companion devices that connect independently while keeping end-to-end encryption for those sessions (WhatsApp multi-device engineering post). A phishing page abuses that product feature:
- The attacker hosts a page that looks like WhatsApp Web and shows a QR code under their control.
- If you scan that code with your phone, you may authorize their session as a linked device.
- Once linked, the attacker’s client can receive messages in that linked session until you remove it.
That is account/device-linking abuse. It is different from decrypting WhatsApp’s end-to-end encryption on the wire.
A fake QR page can lead to an attacker-controlled linked device. Removing an unfamiliar session cuts off that linked session.
flowchart TD
A["Page asks for a WhatsApp QR scan"] --> B{"Opened official web.whatsapp.com independently?"}
B -->|No| C["Do not scan; open official site"]
B -->|Yes| D["Use normal linking with care"]
E["Scanned a suspicious QR code"] --> F["Open Linked Devices on the phone"]
F --> G["Log out unfamiliar sessions"]
G --> H["Review account activity"]
E -.-> I["Attacker client may become linked"]
I -.-> G
What you should do
- Open https://web.whatsapp.com/ yourself. Do not scan QR codes from unexpected websites, ads, or messages.
- If instructions look odd, check WhatsApp’s official Help Center by navigating there independently — not through the suspicious page.
- After an accidental scan, open Linked Devices on your phone and log out any session you do not recognize.
- Two-step verification is still worth enabling, but it does not by itself remove a device that is already linked. Check Linked Devices after a scare.
For defenders and educators
Teach the difference between “someone stole my password” and “I authorized a linked device.” The second failure mode is easy to miss if people only look for password changes. Screenshots of QR pages go stale quickly when codes rotate, so capture video or multiple frames if you are documenting a sample for analysis.
