Receiving urgent documents from trusted contacts? Experts warn of malicious WhatsApp file scam

A multinational cybersecurity company has warned of a fast-spreading scam on WhatsApp that has already targeted users in various countries, including Spain and the UK. Kaspersky, a Russian cybersecurity and anti-virus provider company, has alerted users of the popular mobile app that hackers are using compromised accounts to send malicious files, disguised as important documents including invoices, payment notices, and statements.

How it works: A malicious file from your mum, best friend, or spouse

According to Kaspersky researcher Fareed Radzi, “Attackers are exploiting trust within messaging platforms by using compromised WhatsApp accounts to deliver malicious attachments that appear to originate from known contacts.”

The hackers break into the accounts and then send the malware to its contacts, meaning that, from the victim’s point of view, the malicious documents could appear to be coming from a friend, close family member, client, or colleague. For this reason, users would be far more likely to open the malware without suspecting anything.

To be specific, the malware is an attachment known as VBScript, and is carefully named to appear as if it is a financial report, account notice, or another important document that users would need to open.  According to India’s Cyber Crime Coordination Centre, which issued a similar warning to users, hackers often name these files things like “View Details” or “Invoice” to appear genuine.

A single click, compromising a whole WhatsApp account

Once the victim opens the file, it triggers a so-called “infection” that runs harmful components on the device from external servers. In many cases, the attackers can eventually gain control of the affected device, without the user realising it, through the installation of a remote access tool.

In short, a single click on a document is capable of compromising an entire WhatsApp account, as well as its contact list. So far, the scam is reported to have affected users in multiple countries, including Spain, the United Kingdom, India, Brazil, Mexico, Taiwan, Australia, Russia, Vietnam, and Malaysia. 

Who are the main targets of this scam and how can users stay safe?

According to the cybersecurity firm Quick Heal Technologies, WhatsApp-based malware scams are quickly evolving, with finance teams, senior executives, and accountants among the key targets. However, any user could fall victim to this scam, regardless of their job, age, or status.

Kaspersky, along with its warning, has also advised users to be very cautious of opening unexpected attachments, even if it comes from a close friend or family member. Specifically, the company warned against opening script or executable files, including VBS, EXE, BAT, and JS.

In general, it is also good practice to be wary of messages that urge immediate action, like messages that ask users to send money quickly or, in this case, review a document at once.

For users who are concerned they may have received a malicious document, the best way to verify its legitimacy is by calling the person who sent it and confirming it is genuine.

Otherwise, it is best to avoid opening the document completely, and report the incident to a local cyber crime or law enforcement official.