Cybersecurity firm Kaspersky has issued a warning about a rapidly spreading malware campaign on WhatsApp. Attackers are hijacking legitimate WhatsApp accounts and using them to send malicious attachments disguised as everyday business documents, such as invoices, billing statements, and payment notices.
The campaign has already impacted users in multiple countries, including India, Brazil, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, Vietnam, and Malaysia. Because the malicious files appear to come from known contacts, recipients are far more likely to open them without suspicion.
How the Scam Works
According to Kaspersky researcher Fareed Radzi, the attackers exploit trust within messaging platforms by using compromised accounts to deliver malicious attachments that appear to originate from familiar people. The files are VBScript attachments carefully named to resemble financial reports and account notices.
Once a victim opens the file, it triggers a staged infection chain that quietly downloads and executes additional harmful components from external servers. In many cases, this ultimately installs a remote access tool, granting attackers control over the infected device without the user’s knowledge.
Safety Recommendations
Kaspersky advises users to treat unexpected attachments with caution, even when they come from known contacts. Specifically, avoid opening script or executable files such as VBS, EXE, BAT, and JS unless their legitimacy is confirmed.
India’s Cyber Crime Coordination Centre has also issued a similar alert, noting that fraudsters often name these files “View Details” or “Invoice” to appear genuine. Officials recommend verifying any unexpected document with the sender directly, preferably through a phone call, before opening it. A single click can compromise an entire WhatsApp account and its contact list.
Stay vigilant and always double-check the unexpected, even if it comes from a trusted name.