Cybersecurity agencies and police in Southeast Asia are warning WhatsApp users about malware that arrives from the accounts of people they know, disguised as payment and business paperwork.
Singapore's cyber agency, SingCERT, said in an advisory dated October 27 that it had received multiple reports of malicious files circulating through compromised WhatsApp accounts, and urged users to avoid unexpected attachments even from known contacts. The agency specifically flagged files ending in .exe, .iso or .zip.
On November 2, the Singapore Police Force followed with its own alert. It said malware is downloaded directly onto computers of people using WhatsApp Desktop or WhatsApp Web, and listed file names such as 'Invoice 2026-09-15.iso', 'Statement of Account_54d3.zip' and 'Salary Revision.rar'. According to a report by AsiaOne, the messages come from compromised accounts of friends, colleagues or supervisors, and some victims are told to forward the attachment to their finance managers.
The pattern matches reports from Malaysia. The Star reported on September 29 that Malaysians were posting on Threads about malicious ZIP files, disguised as legitimate documents, arriving from apparently trusted contacts. Malaysian outlet SAYS reported that dozens of people have received ZIP and RAR files disguised as financial documents, with instructions to open them on a desktop or laptop.
Months in the making
The current wave follows a larger campaign that security firm Kaspersky disclosed on June 22. The company said the campaign spread malicious VBScript files to WhatsApp Desktop and Web users, with the highest number of observed victims in Malaysia. Kaspersky's full report lists victims in Malaysia, Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia and Vietnam. A press summary named Malaysia, Brazil, Singapore, Taiwan and Vietnam. Security Affairs, citing the research, reported that around 80 percent of confirmed victims were in Malaysia.
Kaspersky found that the script ultimately installs remote management software, which gives attackers control of the machine. The researchers said the exact method used to compromise the WhatsApp accounts was unknown at the time of writing.
Malaysia's national response team, MyCERT, issued its own alert on June 25. It warned that the malware can install a remote access trojan, maintain access after a reboot, and capture passwords, banking PINs and one-time passwords.
India has issued a warning too
India's CERT-In issued an advisory the same week. It warned of a 'large-scale malware distribution campaign' targeting WhatsApp Desktop and Web users through malicious attachments sent from compromised accounts. The advisory, based on Kaspersky and Securelist findings, said a successful attack can give criminals remote access to a device, enable credential theft and fraud, and allow further malware to be deployed.
What users should do
Authorities advise against opening unexpected ZIP, RAR, ISO, EXE or script files, even when they come from a known contact. Users should verify suspicious files with the sender by phone, enable two-step verification on WhatsApp, review Linked Devices regularly, and never share verification codes or PINs. Kaspersky also advises against opening script and executable file types, including .vbs, .vbe, .bat, .cmd, .js and .ps1, unless their legitimacy has been verified independently.
