.png){kind=logo}
A large-scale malware campaign is currently spreading across WhatsApp, according to cybersecurity firm Kaspersky. Hackers are using compromised WhatsApp accounts to send malicious files disguised as everyday business documents like invoices, billing statements, and payment notices.
The campaign has already affected users in multiple countries, including India, Brazil, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia.
Since the files come from known contacts, victims are far more likely to open them without suspicion.
The malicious files are VBScript attachments, carefully named to look like financial reports and account notices. Kaspersky researcher Fareed Radzi explained how the scam works.
"Attackers are exploiting trust within messaging platforms by using compromised WhatsApp accounts to deliver malicious attachments that appear to originate from known contacts," Radzi said.
Once a victim opens the file, it triggers a staged infection chain that quietly pulls in and runs additional harmful components from external servers.
In many cases, this process ends with the installation of a remote access tool, giving attackers control over the infected device without the user realising it.
Also read: How to Restore WhatsApp Chats from iCloud
Kaspersky advised users to treat unexpected attachments with caution, even when they appear to come from people they know. The firm specifically warned against opening script or executable files like VBS, EXE, BAT, and JS unless their legitimacy is confirmed first.
India's Cyber Crime Coordination Centre has also issued a similar warning, noting that fraudsters often name these files things like "View Details" or "Invoice" to appear genuine.
Officials recommend verifying any unexpected document with the sender directly through a phone call before opening it, since a single click can compromise an entire WhatsApp account and its contact list.
