Top News

India’s CERT-In has warned WhatsApp Web and Desktop users about a malware campaign spreading through VBScript files sent via compromised accounts. Since messages come from known contacts, users are more likely to open them. Once executed, the malware can give attackers remote access, steal credentials and spread across networks.

India's national cybersecurity watchdog has issued an advisory warning WhatsApp Web and Desktop users about a large-scale malware distribution campaign that could give attackers unauthorised access to their devices. The Indian Computer Emergency Response Team (CERT-In) said the campaign distributes malicious Visual Basic Script (VBScript) files through direct messages on the platform.

The advisory, prepared based on findings from Kaspersky and Securelist, said threat actors are leveraging compromised WhatsApp accounts to send malicious attachments directly to victims, which makes the messages appear legitimate and significantly raises the likelihood of a successful compromise.

How the attack works

According to CERT-In, attackers use previously compromised WhatsApp accounts to send malicious VBScript files to existing contacts, and because the messages originate from trusted contacts, recipients may be more inclined to open the attachment. WhatsApp's cross-platform nature, which lets users exchange messages, files, images and videos across desktop and web, is being exploited as the delivery mechanism for these payloads.