CERT-In warns of malware campaign targeting WhatsApp Web and Desktop users

India's national cybersecurity watchdog has issued an advisory warning WhatsApp Web and Desktop users about a large-scale malware distribution campaign that could give attackers unauthorised access to their devices. The Indian Computer Emergency Response Team (CERT-In) said the campaign distributes malicious Visual Basic Script (VBScript) files through direct messages on the platform.The advisory, prepared based on findings from Kaspersky and Securelist, said threat actors are leveraging compromised WhatsApp accounts to send malicious attachments directly to victims, which makes the messages appear legitimate and significantly raises the likelihood of a successful compromise.'Boss Scam' On WhatsApp: New CEO Fraud Bypasses Traditional Cybersecurity ChecksHow the attack worksAccording to CERT-In, attackers use previously compromised WhatsApp accounts to send malicious VBScript files to existing contacts, and because the messages originate from trusted contacts, recipients may be more inclined to open the attachment. WhatsApp's cross-platform nature, which lets users exchange messages, files, images and videos across desktop and web, is being exploited as the delivery mechanism for these payloads.A report by Whalesbook on the advisory noted that when a user clicks on or executes the malicious VBScript attachment, the malware can grant attackers remote access to the device, which then allows criminals to steal sensitive information including login credentials, and potentially install further malicious software.FBI Warns Microsoft 365 Users Of New Hacking Tool That Is Scamming Thousands: Here's All You Need To KnowWhat's at risk?CERT-In has warned that a successful attack can have cascading consequences. As per the advisory, a successful malware attack can lead to remote access of the device by cybercriminals, theft of credentials to carry out fraudulent activities, deployment of additional malware, infection of the network the user is connected to, and disruption of business resulting in financial losses.For Indian businesses specifically, the stakes go beyond individual device security. With WhatsApp serving as a primary communication tool for millions of enterprises, from small startups to large corporations, a security breach through this channel can lead to direct financial losses, operational downtime, and reputational damage. The Whalesbook report framed the advisory as a reminder that cybersecurity is increasingly a board-level concern for companies that rely heavily on the messaging platform for daily operations.CERT-In Warns of WhatsApp Flaws That Could Enable Cyber AttacksCERT-In's advisory to usersThe agency has laid out clear precautionary steps for users to avoid falling victim to the campaign. CERT-In's note instructs users, "Do not open attachments you were not expecting, even if they come from a friend, colleague, or family member."Beyond simply avoiding unexpected files, the watchdog has suggested that users make a phone call or send a separate message to the sender to cross-check whether the person intentionally sent the file before opening it. This step is particularly important given that the entire attack hinges on exploiting the implicit trust users place in messages from known contacts.

CertIn warned WhatsApp web and desktop users to be cautious of any attachments, even if they come from a friend, colleague or family member

According to the advisory, if the malware is executed successfully, it can give cybercriminals remote access to the infected device, allowing them to steal login credentials for fraudulent use and install further malicious software.

WhatsApp web and desktop users are being targeted by a large-scale malware distribution campaign that could give criminals unauthorised access and compromise their devices, national cybersecurity watchdog CertIn said in a note. The Indian Computer Emergency Response Team has warned WhatsApp web and desktop users to be cautious of any attachments, even if they come from a friend, colleague or family member. "It has been observed that a large-scale malware distribution campaign is targeting WhatsApp Desktop and WhatsApp Web users. The campaign distributes malicious Visual Basic Script (VBScript) files through direct messages on the platform," CertIn said on June 25. The note prepared based on Kaspersky and Securelist findings said that the threat actors leverage compromised WhatsApp accounts to send malicious attachments directly to victims, making the messages appear legitimate and significantly increasing the likelihood of successful compromise. "WhatsApp is a cross-platform instan

In an advisory, the Indian Computer Emergency Response Team (Cert-In) said the campaign is targeting users through malicious file attachments sent via WhatsApp.

National cybersecurity watchdog CertIn said that a large-scale malware distribution campaign is targeting WhatsApp Desktop and WhatsApp Web users that could give criminals unauthorised access and compromise their devices.