Home Ministry's Cybercrime Agency Issues Advisory on Malicious WhatsApp Attachments
The Indian Cyber Crime Coordination Centre (I4C), operating under the Ministry of Home Affairs, has issued a public advisory warning WhatsApp users about a new cyber fraud tactic involving malicious files disguised as everyday documents.
According to the agency, cybercriminals are circulating files with names such as "View Details," "Invoice," or "Document" to persuade users to download malware. While these files appear legitimate, installing them could compromise both the user's device and their WhatsApp account.
The advisory also highlights the increasing importance of cybersecurity awareness alongside robust bookkeeping services in india, as businesses rely heavily on secure digital communication and financial data protection.
Malware Hidden Inside ZIP Files
I4C said the malicious files commonly carry .exe or .dll extensions and are often compressed inside ZIP folders to avoid raising suspicion.
Once a victim downloads and executes the file, the malware attempts to infiltrate the system and gain access to active WhatsApp Web sessions.
By exploiting these active sessions, attackers may take control of the victim's messaging account without immediately alerting the user.
Compromised Accounts Used for Financial Fraud
If attackers successfully gain access to a WhatsApp account, they may misuse it to contact friends, relatives, colleagues, and business associates.
According to cybersecurity experts, compromised accounts have been used to:
- Request emergency money transfers.
- Impersonate the account owner.
- Circulate fraudulent investment schemes.
- Share malicious links and files.
- Carry out additional cyber fraud using trusted contacts.
Since messages originate from a legitimate account, recipients are often more likely to trust them.
I4C Advises Users to Avoid Unknown Executable Files
The cybercrime agency has urged citizens to exercise caution before downloading attachments received through WhatsApp, especially from unknown numbers.
Users are advised to:
- Never download files from unverified senders.
- Delete files ending in .exe or .dll immediately.
- Verify the sender's identity before opening attachments.
- Be cautious of compressed ZIP folders containing unknown files.
Cybersecurity professionals note that genuine WhatsApp documents are generally shared in formats such as PDF, DOCX, JPG, or PNG, whereas executable files can install malicious software on a device.
What to Do If You Downloaded a Suspicious File
If a user has already downloaded or installed a suspicious attachment, experts recommend taking immediate action.
Suggested steps include:
- Open WhatsApp's Linked Devices section and log out of all active sessions.
- Perform a complete antivirus scan using trusted security software.
- Change passwords for important online accounts as a precaution.
- Monitor banking and email accounts for unusual activity.
Acting quickly may reduce the risk of further compromise.
Cybercriminals Combining Malware With Social Engineering
Cybercrime expert and former IPS officer Prof. Triveni Singh said attackers are increasingly combining malware with social engineering techniques to deceive users.
He advised people to verify every unknown file, link, or attachment before opening it, warning that even a single careless click can expose sensitive digital services including WhatsApp, banking applications, email accounts, and other online platforms.
Report Suspicious Activity Immediately
I4C has encouraged citizens to report suspicious messages, malicious files, or cyber fraud attempts without delay through the National Cyber Crime Helpline (1930) or the National Cyber Crime Reporting Portal.
Officials say early reporting can significantly improve the chances of preventing financial losses and help investigators trace cybercriminals more effectively.
Experts also recommend maintaining updated applications, enabling two-factor authentication wherever available, and avoiding downloads from unknown sources as essential safeguards against evolving cyber threats.