Police warn of compromised WhatsApp accounts infecting computers through malicious files

Scammers are taking over WhatsApp accounts to spread malware to computers, the police warned on Monday (Nov 2).

While victims have not reported any monetary losses so far, police said scammers might have stolen personal information.

In an advisory, they said victims would receive messages from compromised WhatsApp accounts belonging to known persons, including friends, colleagues, or supervisors.

The messages would contain file attachments with seemingly legitimate or work-related file names such as "Invoice 2026-09-15.iso", "Statement of Account_54d3.zip" and "Salary Revision.rar".

Scammers would ask their victims to open the file on a computer, even telling some to forward the attachments to their finance managers.

The malware would be downloaded directly into the computers of users of WhatsApp Desktop or WhatsApp Web.

Police said the malware can record and track keystrokes, capture screenshots, and communicate with an external command-and-control server.

In many cases, the victims' WhatsApp accounts were taken over and used by scammers to disseminate the same malware to their contacts.

Some of these compromised accounts were also used to solicit money from the victims' contacts.

Members of the public are advised to enhance the security of their Whatsapp accounts, by enabling two-step verification and regularly checking the devices linked to their WhatsApp account.

They can safeguard against scams by using the ACT (Add, Check, Tell) framework, which involves adding the ScamShield app and setting security features.

If in doubt, call the ScamShield helpline at 1799.

[[nid:749126]]

lim.kewei@asiaone.com