- Cybersecurity agencies in Malaysia and Singapore warn about malware files sent through hacked WhatsApp accounts.
- The files look like invoices, bank statements and business documents, but they infect Windows computers.
- Researchers have found similar WhatsApp malware campaigns across several countries, with attackers using hacked accounts.
Cybersecurity agencies in Malaysia and Singapore have issued fresh warnings about harmful files on WhatsApp. Hackers send these files from hacked accounts.
The files look like invoices, bank statements and business documents. Their real goal is to infect Windows computers.
Malaysia and Singapore Warn About Fake Invoices Sent Through WhatsApp
Cybercriminals are using hijacked WhatsApp accounts to spread malware that looks like real financial documents. This trend has raised concern among cybersecurity authorities in Malaysia and Singapore.
The attacks use attachments that pose as invoices, statements of account, payment records and other business papers. Instead of real documents, the files hide malware. That malware aims to compromise computers and give attackers unauthorized access.
On October 29, Malaysia’s national emergency response team, MyCERT, issued an advisory about an active campaign. It confirmed that attackers mainly use WhatsApp to send harmful ZIP attachments. According to the advisory, some messages came from contacts whose accounts may have been hacked.
Others came from strangers who pretended to be business contacts. That means a message from a known friend could still be dangerous. A message from a fake business contact could be dangerous too.
The files told recipients to open or extract them on Windows computers. MyCERT studied six malware samples. Its analysis showed that attackers misused real apps with digital signatures. Those apps launched the harmful parts and installed backdoors for remote control. In simple terms, the attackers hid their tools behind trusted software.
Singapore reported similar activity. On October 28, its Computer Emergency Response Team, SingCERT, issued an advisory after receiving several reports. The reports described harmful files spreading through hacked WhatsApp accounts. The agency warned that victims could send similar files to their contacts without knowing. That would let the infection spread further.
On November 2, the Singapore Police Force issued another warning about scams that use malware on computers. Police said harmful attachments can steal personal information, record keystrokes and capture screenshots. The malware can also contact outside servers controlled by the attackers. Police added that hacked accounts sometimes asked contacts for money.
The three warnings arrived within about a week. Each one describes malware that reaches victims through WhatsApp.
Kaspersky Finds Victims in Many Countries
The latest warnings follow an earlier investigation by cybersecurity firm Kaspersky, published on June 22, 2026. Kaspersky’s report came months before the agency warnings. Its researchers found a malware campaign aimed at users of WhatsApp Desktop and WhatsApp Web. The attackers spread harmful VBScript files. Those files pretended to be business and financial documents.
Kaspersky found victims in Malaysia, Brazil, India, Mexico, Singapore, the United Kingdom, Spain, Taiwan, Australia, Russia and Vietnam. Malaysia had the highest number of victims in that investigation. Reports say researchers have seen similar WhatsApp malware campaigns across several countries. In these cases, attackers use hacked accounts to reach more victims.
Both Kaspersky and Malaysia’s agency describe files made to look like business paperwork. Kaspersky named VBScript files, while MyCERT named ZIP attachments. The reports show similar methods, but they cover different time periods and different activities. They do not prove that every incident belongs to one coordinated campaign. They also do not show that every country faces the same attack at the same time.
The shared method relies on trust between WhatsApp contacts. Attackers use hacked accounts to send convincing attachments. Recipients then open files they would normally question. Once a victim runs the file, the malware can open remote access. It can steal sensitive information. It may also use the hacked account to reach more contacts.
Agencies Urge WhatsApp Users to Slow Down Before Opening Files
Cybersecurity agencies urge WhatsApp users to treat unexpected attachments with caution. This advice applies even when the file appears to come from a trusted contact. Agencies stress this point because attackers use accounts that people already know. WhatsApp is also developing ways to detect suspicious activity directly on users’ devices, including a new on-device scam alert feature that doesn’t require reading user messages.
Users should avoid opening suspicious ZIP, RAR, ISO, VHD or executable files. The risk is higher when a sender insists that they extract or run the contents on a computer. A real invoice or bank statement should not need a program to open it.
Anyone who receives an unexpected attachment should confirm that it is real. They should contact the sender through a separate channel, preferably a phone call.
Users should also turn on WhatsApp Two-Step Verification. They should check their Linked Devices often and remove sessions they do not recognise. They should never share verification codes or account PINs with anyone.
Anyone who opened a suspicious file should disconnect that computer from the network. They should then look for proper security help. They should also secure their online accounts from a separate, trusted device.
The bigger worry is that criminals no longer need to message strangers. By taking over existing accounts, they use real relationships to make harmful files look trustworthy. A familiar WhatsApp contact does not guarantee that an attachment is safe.
Share this article
About the Author
Farwa is an experienced InfoSec writer and cybersecurity journalist skilled in writing articles related to cybersecurity, AI, DevOps, Big Data, Cloud security, VPNs, IAM, and Cloud Computing. Also a contributor on Tripwire.com, Infosecurity Magazine, Security Boulevard, DevOps.com, and CPO Magazine.
More from Farwa SajjadRelated Posts
Apple Warns German Ministers and Lawmakers of Possible iPhone Spyware Attacks
Apple started sending spyware alerts to German ministers and lawmakers on October 29, and Germany...
Germany’s Charité Hospital Breach Exposes Names and Emails of 140,000 People
Hackers attacked the Charité webpage server and stole confidential information, including the names ...
Apple iOS 27 Child Safety Features Spark Unverified Surveillance Claims in Australia
Social media posts say Apple and Google now spy on private messages, video calls and photos in Austr...
Lazarus Group Targets South Korea in New Spy Campaign Using Post-Quantum Encryption
Kaspersky links a new spy campaign called Operation FlashHole to North Korea’s Lazarus Group. ...
Signal, Windscribe Threaten Exit Over Canada’s Six-Month Metadata Rules
Bill C-22 of Canada demands that telecoms and messaging applications retain the metadata of all of t...
Hacker Claims Nearly 208,000 OpenRouter API Keys Are for Sale
A malicious individual has announced he is selling an OpenRouter database containing nearly 250,000 ...
