Stories
WhatsApp Hack Alert: 5 Signs Your Account May Be Compromised By Malware And What To Do
- •CERT-In warns of a malware campaign targeting WhatsApp Web and Desktop users via malicious attachments disguised as business documents.
- •Attackers use already compromised WhatsApp accounts to send malicious VBScript files to contacts, making them appear legitimate.
- •Opening these files on Windows computers can lead to remote access for attackers, credential theft, data exfiltration, and further malware installation.
- •Signs of a compromised account include unfamiliar linked devices, unsent messages, suspicious messages from your account reported by contacts, unexpected authorization notifications, and unusual account setting changes.
- •To protect yourself, regularly check linked devices, enable two-step verification, verify unexpected files with senders through other channels, and keep software updated.
Key Questions Answered
The Indian Computer Emergency Response Team (CERT-In) warned that a malware campaign is targeting WhatsApp Web and Desktop users by distributing malicious VBScript files disguised as ordinary business documents like invoices and bank statements. These files are sent from already compromised accounts to make them appear legitimate, and opening them can lead to remote access, credential theft, and system infections on Windows computers.
Once a malicious VBScript file is executed on a Windows computer via WhatsApp Web or Desktop, it creates a working directory, downloads additional attacker-controlled scripts through Windows Script Host, and installs a Remote Monitoring and Management package. This grants attackers remote access, enabling credential theft, data and system compromise, and business disruption.
Users can check their WhatsApp account security by reviewing the Linked Devices section for unrecognized computers or browsers. Other warning signs include unexpected messages sent from the account, contacts reporting strange files, unexpected authorization alerts, unexpected logouts, and unauthorized changes to account settings or two-step verification PINs.
