WA Folders
Home / Blog

WhatsApp Web malware warning: how to check your linked devices

Published

To check whether someone else is using your WhatsApp, open WhatsApp on your phone, tap More (the three dots) and then Linked devices, and log out any device you don't recognize. That list is the quickest test after this week's warning about hijacked WhatsApp Web sessions, and it only takes a minute.

What the warning says

On October 26, 2026, Pakistan's National Cyber Emergency Response Team (NCERT) put out a high-alert advisory about phishing and malware attacks through WhatsApp Web, WhatsApp Desktop and email, as Geo News reported. According to that report:

  • Attackers pretend to be government officials or departments and send malicious files dressed up as official documents.
  • An infected Windows computer could give attackers remote access, passwords and sensitive data.
  • Attackers could hijack WhatsApp Web sessions and send fraudulent messages to your contacts from your own number.
  • Unexpected files from familiar numbers, and unknown devices in your linked devices list, are possible signs of an attack.

NCERT told officials who handle sensitive information to avoid WhatsApp Web and Desktop on Windows systems. For everyone else, its advice comes down to the steps below.

How to check your linked devices

WhatsApp Web, the desktop apps and a second phone all count as linked devices. WhatsApp's linked devices article says you can link up to four at a time, and you review them from your phone:

  1. Open WhatsApp on your phone.
  2. Tap More (three vertical dots), then Linked devices.
  3. Look at each entry. To remove one, tap it and then LOG OUT.

WhatsApp also recommends turning on push notifications on your phone, so you get an alert when a new device is linked and can review or remove it right away. Linked devices you don't use are disconnected automatically after 30 days of inactivity, and they log out if your phone goes unused for more than 14 days.

If you can't tell which entry is which, log out all of them. You can link your own computer again by scanning the QR code, which takes a few seconds.

Other steps from the advisory

  • Don't open unexpected files, even from a number you know. Check with the sender another way first.
  • Never share a verification code or OTP. A code you didn't ask for usually means someone is trying to register or link your number. Our post on WhatsApp codes you didn't request explains what to do.
  • Turn on two-step verification in WhatsApp, and two-factor sign-in on your other accounts.
  • Keep Windows and your browser updated.
  • If you think a computer is compromised, disconnect it from the internet, keep the suspicious messages as evidence and don't reopen the files.

WhatsApp adds one more: only link through official WhatsApp apps and web.whatsapp.com. It says unofficial apps and websites can put your account at risk and can lead to a temporary or permanent ban. A ban or restriction also cuts off linked devices, which our post on why WhatsApp Web stops working when your account is restricted covers.

What a WhatsApp Web extension can and can't see

We build WA Folders, a Chrome extension for WhatsApp Web, so we checked what ours can reach before writing this. We read the current version's manifest and code on October 27, 2026.

  • It only runs on web.whatsapp.com. That's the only site it has permission to read.
  • It works with the chats WhatsApp Web has loaded in your browser tab, which is how it sorts them into folders and searches them.
  • It can't link a device, and it can't see or change your linked devices list. That list lives on your phone.
  • It never sends a message. Quick replies paste text into the box and you press Send yourself. Its panel says "Local only. No bulk send."
  • Your folders and notes are stored in Chrome on your computer. The optional AI features are off by default and send text only to the AI provider you pick, with your own key.

Any extension that runs on WhatsApp Web can read what's on that page, so install only ones you trust and remove the ones you don't use. You can see each extension's site access on Chrome's extensions page.

FAQ

How do I know if my WhatsApp Web has been hacked?

Check Linked devices on your phone (More, then Linked devices). A computer or browser you don't recognize is the clearest sign. Other signs NCERT lists are messages you didn't send and unexpected files from contacts you know.

How do I log out of WhatsApp Web from my phone?

Open WhatsApp on your phone, tap More, then Linked devices, tap the session you want to remove and choose LOG OUT. You can log out every device the same way.

Is WhatsApp Web safe to use?

Your messages on linked devices stay end-to-end encrypted, according to WhatsApp. The risk the advisory describes comes from malware on the computer and from hijacked sessions, so keep your computer updated, don't open unexpected files and check your linked devices regularly.

Should I stop using WhatsApp Web on Windows?

NCERT's advice to avoid WhatsApp Web and Desktop on Windows was aimed at officials handling sensitive information. For most people the practical steps are updates, two-step verification and checking linked devices.

Can a Chrome extension hijack my WhatsApp account?

An extension that runs on web.whatsapp.com can read that page, so only install extensions you trust. WA Folders can't link devices or see your linked devices list, never sends messages and runs only on WhatsApp Web.

Sources