NCERT issues high-level alert on WhatsApp Web malware attacks

Pakistan's National Cyber Emergency Response Team (National CERT) has issued a high-level cybersecurity advisory warning of targeted phishing and malware attacks that arrive through WhatsApp Web, the WhatsApp desktop app and email. The attacks are aimed at Windows systems.

According to the advisory, government officials, regulators and people who handle sensitive information are the main targets. Attackers impersonate government departments, officials and trusted contacts, and send harmful files, often disguised as official documents. Opening such a file can infect a Windows computer.

If a system is compromised, National CERT says the risks include remote control of the device, theft of passwords and theft of confidential data. TechJuice reported that the agency listed indicators of compromise such as unexpected messages, unusual attachments, unknown linked devices and suspicious data transfers, but has not yet supplied specific attacker domains or file hashes.

The advisory also raises the risk of session hijacking. A WhatsApp Web session lets a computer use an account already logged in on a phone, and an attacker who takes it over could impersonate the user. For this reason, National CERT says an unexpected message or file from a known contact can itself be a sign of targeting, and an unfamiliar device in the Linked Devices list may indicate unauthorised access.

As a precaution, officers who handle sensitive information are advised to stop using WhatsApp Web and the desktop app on Windows, and not to move files received on WhatsApp onto official Windows computers. Daily Pakistan noted that the warning does not amount to a nationwide WhatsApp ban.

For all users, the advisory recommends ending suspicious WhatsApp Web sessions at once, avoiding unverified links and attachments, and confirming requests through a separate channel. Passwords, one-time passwords and verification codes should never be shared. Windows, browsers and other software should be kept updated, and two-factor authentication and WhatsApp two-step verification should be turned on. Users can check Settings, then Linked Devices, and remove any device they do not recognise.

If a compromise is suspected, the affected device should be disconnected from the internet and local networks immediately. Suspicious messages, attachments and system logs should be preserved as evidence and not reopened, and the incident reported to security teams. National CERT also directed government departments and focal persons to pass the warning on to their staff.