Both are considered correct nowadays.
So it depends on who you are talking to.
You may want to consider using "whom" at a convention of retired
English teachers or in the company of extremely pedantic scholars, but
"who" would be fine 99.99999% of the time.
CJ