The Indian Computer Emergency Response Team (CERT-In) has issued a fresh cybersecurity advisory warning WhatsApp Web and WhatsApp Desktop users about a dangerous malware campaign that is spreading through compromised WhatsApp accounts. According to the advisory, cybercriminals are distributing malicious Visual Basic Script (.vbs) files via direct messages, potentially giving attackers access to victims' computers and sensitive information.
Security experts are urging users to verify every unexpected attachment before opening it, even if it appears to come from a trusted contact.
Why Has CERT-In Issued This Warning?
According to CERT-In, cybercriminals are actively targeting users through a large-scale malware distribution campaign affecting WhatsApp Web and WhatsApp Desktop.
The advisory, based on security findings from Kaspersky and Securelist, warns that attackers are exploiting compromised WhatsApp accounts to spread malicious attachments disguised as legitimate files.
Because the messages originate from trusted contacts, users are far more likely to open the attachments without suspecting foul play.
How Does This WhatsApp Malware Attack Work?
The attack follows a simple but highly effective strategy:
Cybercriminals first gain access to a user's WhatsApp account.
They send a malicious .vbs (Visual Basic Script) attachment to the victim's contacts.
Friends, colleagues, or family members receive the file from someone they know and trust.
If the attachment is opened, malicious code executes on the victim's computer.
This technique relies heavily on social engineering rather than technical vulnerabilities.
What Happens If You Open the Malicious File?
Opening a malicious VBScript attachment can expose users to several cybersecurity risks, including:
Remote access to the infected computer
Theft of passwords and login credentials
Installation of additional malware
Unauthorized access to sensitive personal or business data
Infection spreading across an organization's network
Business disruption and financial losses
In corporate environments, a single compromised system can potentially affect multiple connected devices.
CERT-In's Safety Tips for WhatsApp Users
The cybersecurity agency has advised users to follow these precautions:
Never open unexpected attachments without verification.
Confirm suspicious files by calling or messaging the sender separately.
Be cautious if a contact suddenly sends unusual files or behaves differently than normal.
Avoid downloading unknown script files or executable attachments.
Keep your operating system and antivirus software updated.
Regularly scan your device for malware.
Enable two-factor authentication wherever possible.
Why WhatsApp Web Users Are More Vulnerable
Unlike smartphones, WhatsApp Web and Desktop operate on computers that often contain:
Office documents
Banking information
Business credentials
Personal files
Company networks
A successful malware infection can therefore have much broader consequences than compromising a single messaging app.
Cybersecurity Threats Continue to Rise
CERT-In has repeatedly warned users and technology companies about the increasing sophistication of cyberattacks, including AI-assisted scams, phishing campaigns, and malware distribution.
The latest advisory highlights how attackers are increasingly exploiting trusted messaging platforms to trick users into compromising their own devices.
Stay Alert Before Opening Any WhatsApp Attachment
As WhatsApp has become an essential communication tool for both personal and professional use, blindly trusting files—even those sent by friends or colleagues—can be risky. Verifying attachments before opening them remains one of the simplest yet most effective ways to protect yourself against malware and cyber fraud.
Cybersecurity experts recommend treating every unexpected attachment with caution, regardless of who sends it.
England captain Joe Root equaled Sachin Tendulkar’s record for the most half-centuries in T
The National Payments Corporation of India (NPCI) has clarified concerns surrounding the revised
Unacademy-UpGrad Merger Gets CCI Approval; Big Boost for India's EdTech Industry
India's edtech industry is set for a major transformation after the Competition Commission of Ind
Tata Chemicals Kenya Crisis: Ruto Orders Shutdown, Company Reveals Its Next Move
Tata Chemicals has responded to Kenyan President William Ruto’s order to stop its operation
Selecting the right life insurance policy is one of the most important financial decisions for ev
Motorola Moto Pad 70 Launched at ₹33,999: 10,200mAh Battery, 2.5K Display and Dimensity 6400
Motorola has expanded its tablet portfolio in India with the launch of the Moto Pad 70. The new t
Bank of America to Buy 49.9% Stake in Jio Credit for ₹18,268 Crore: Check Deal Details
A major development has emerged in India's financial services sector. Bank of America and Jio Fin
WPL 2027 Auction: October 29 in Kochi Likely; Brabourne Confirmed, Varanasi Venue in Focus
The Women's Premier League 2027 auction is likely to be held in Kochi on October 29, while the Bo
The Google Pixel 11 starts at ₹89,999 for the 12GB RAM + 256GB storage variant. The 12GB + 512G
EPFO Alert: Company Deducting PF But Money Not Showing? Check EPF e-Passbook Now
Every month, a portion of your salary is deducted towards the Employees' Provident Fund (EPF). Th
