Malaysians are reporting on Threads that they are receiving malicious ZIP files masquerading as legitimate PDF files from what appear to be trusted contacts on WhatsApp.
Some users even claim that opening these files may result in a device – such as a computer or smartphone – being hijacked, with passwords and account being stolen.
Cybersecurity firm Trend Micro reported similar cases involving Brazilian WhatsApp users last October.
Findings from the company include that compromised WhatsApp accounts would be used to further spread the infection by sending the ZIP file to other contacts.
The file would also be sent alongside instructions for recipients to open it on a desktop computer and, if opened, quietly instructs the computer to download and install malware in the background without users noticing.
This would then give threat actors the ability to access and monitor a computer for activities such as online banking. At the same time, the computer will continue to spread the file to contacts through WhatsApp Web.
A similar case involving phishing messages involving Malaysia was reported by Kaspersky in June this year. While this case also involved files sent through WhatsApp, it delivered malware via VBS files rather than ZIP files.
Banks including OCBC Malaysia and UOB Malaysia had previously stated on their respective social media pages for customers to beware of WhatsApp and WhatsApp Web messages containing VBS and ZIP, along with MSI and EXE files, advising against opening them.
Both banks further say that the files may conceal malware that may jeopardise device security, urging customers to be wary of opening suspicious files.
StarLifestyle has reached out to the National Cyber Security Agency for comment.
