Viruses are being mass-distributed via WhatsApp disguised as invoices, statements, and business documents. The key danger is that the files come from hacked accounts of known contacts, so they do not raise suspicion in the recipient.
National cyber agencies of Malaysia and Singapore have already issued warnings — the attack is cross-border in nature and affects both private users and professional market participants.
How the attack works
The attackers seize someone else's WhatsApp account and, on behalf of the owner, send to their contacts an archive or a file disguised as a document. The recipient is asked to open the attachment on a computer running Windows. After launching, a backdoor for remote access is activated on the machine.
The attackers then gain virtually full control over the device. They can:
- steal logins and passwords;
- record keystrokes;
- take screenshots;
- hijack the WhatsApp account and spread the virus further along the chain of contacts.
For an investor, this is a direct risk of losing funds. Intercepted passwords and screenshots open access to exchange accounts, banking apps, and crypto wallets. One opened "invoice" from an acquaintance could cost an entire deposit.
Malaysia's MyCERT center confirmed in late October an active distribution of malicious ZIP archives disguised as invoices and payment documents. Singapore's SingCERT issued a warning after complaints about hacked accounts, and in early November the Singapore police repeated it. Earlier, in the summer, a similar campaign was recorded with victims in Malaysia, Brazil, Singapore, Taiwan, and Vietnam — most victims were in Malaysia. These are different campaigns from different periods, not one single common attack.
How not to become a victim of scammers
A file does not become safe just because an acquaintance sent it. Their account could have been hacked, and they themselves do not know about it.
Basic protection rules:
- do not open unexpected ZIP, RAR, ISO, and EXE attachments;
- call the sender back and verify whether they actually sent the file;
- enable two-step verification in WhatsApp;
- regularly check the list of linked devices;
- never share the verification code and PIN with anyone.
If an account has already been hacked, everyone in the contact list becomes the next target. One call to the sender protects both you and your acquaintances.
Cryptalist analysis: The growing number of attacks via messengers indicates a shift in the threat vector from phishing emails to trusted communication channels, where the victim is psychologically less vigilant. For the crypto industry, this means growing operational risks on the user side and increased demand for hardware wallets and separate key storage. Institutional players should consider employee communications security as part of their overall risk management model.