India’s national cybersecurity watchdog CERT-In warns that a large-scale malware distribution campaign is targeting WhatsApp Web and WhatsApp Desktop users. CERT-In says the activity involves malicious attachments delivered via direct messages on the platform. According to the advisory, threat actors use compromised WhatsApp accounts to send victims Visual Basic Script (VBScript) files, with messages designed to look legitimate because they appear to come from a trusted contact. The warning is based on findings cited by CERT-In from Kaspersky and Securelist. The advisory says that if the malicious file is executed successfully, it can give criminals remote access to the infected device. It also notes that this access can be used to steal login credentials for fraudulent use and to install additional malicious software. CERT-In urges users to be cautious about opening attachments they were not expecting, including files sent by friends, colleagues, or family members, since the sending accounts may have been compromised.