Cyber agency warns of WhatsApp phishing campaign against officials

Pakistan's National Cyber Emergency Response Team (NCERT) has issued a high-alert advisory warning that attackers are using WhatsApp Web, WhatsApp Desktop and email to plant malware on Windows computers, targeting government officials and anyone else handling sensitive information.

According to the advisory, reported by Daily Times, TechJuice and Minute Mirror, the attackers pose as government officials and state departments and send files disguised as official documents. Opening the attachment or link is enough to compromise the machine. From there, the agency says, attackers can run remote commands, steal saved passwords and extract confidential records.

The agency said compromised machines also expose live WhatsApp Web sessions. An attacker who takes over a session can pose as the legitimate user, operating from that person's verified phone number, and send fraudulent messages and malicious attachments onward to their contacts: turning one compromised account into a route into other offices.

NCERT listed the warning signs as unexpected messages or official-looking files arriving from known contacts, unrecognised entries under WhatsApp's linked devices tab, and suspicious data transfers. TechJuice reported that the advisory rates the threat high risk but does not publish specific attacker domains or file hashes.

The guidance is blunt for officials dealing with sensitive material: stop using WhatsApp Web and WhatsApp Desktop on Windows computers, and verify any unexpected attachment through a separate channel before opening it. Users should never share account passwords, one-time passwords or verification codes, and media received through messaging apps should not be moved onto official government computers. Sensitive official communication should go through approved secure platforms.

On the technical side, the agency recommends keeping operating systems, browsers and security software patched, running endpoint detection or anti-malware tools, restricting unauthorised applications and scripts, and enabling multi-factor authentication on official accounts along with WhatsApp's own two-step verification.

If a compromise is suspected, the device should be disconnected from the internet immediately, the incident reported to the organisation's security team, and system logs and suspicious messages preserved for forensic investigation. Security staff should then guide the user to reset credentials from a device known to be clean.

NCERT has directed government departments and their designated focal persons to circulate the advisory to staff promptly.