ISLAMABAD – The National Cyber Emergency Response Team (National CERT) has issued a high-level alert over targeted phishing and malware attacks through WhatsApp Web, WhatsApp Desktop and email, warning that malicious files could expose sensitive information and allow attackers to take control of Windows computers.
The advisory identifies government bodies, regulators, public-sector organisations, senior officials and people handling sensitive information as high-risk targets. It advises them to refrain from using WhatsApp Web and Desktop on Windows systems.
In January this year, the National CERT had issued a nationwide alert warning that both individual and business accounts were at serious risk.
According to the advisory, attackers are impersonating government officials, departments and trusted contacts to trick users into opening malicious documents, archives, scripts and executable files.
Signs of a targeted attack
A compromised computer could allow attackers to gain remote access, steal passwords and confidential documents, and extract sensitive data. The breach could also expose active WhatsApp Web sessions, enabling hackers to impersonate users and send fraudulent messages to their contacts.
The advisory identifies unexpected messages, urgent requests or unusual files received from familiar contacts as possible signs of a targeted attack. Unrecognised devices appearing in WhatsApp’s “Linked Devices” section, unauthorised messages and unusual account activity may also indicate a security breach.
Precautionary measures
National CERT has urged users to reject unverified links, messages and attachments and independently verify unusual requests, even when they appear to come from known contacts. It has also warned against sharing passwords, one-time passwords (OTPs) or authentication codes.
Users have been advised to terminate suspicious WhatsApp Web and Desktop sessions, review linked devices through the mobile app and avoid transferring WhatsApp files to official Windows computers through other channels.
The advisory recommends keeping Windows, browsers and other software updated, maintaining reliable anti-malware protection and enabling multi-factor authentication and WhatsApp’s two-step verification.
Reporting a suspected breach
If a computer is suspected of being compromised, users should immediately disconnect it from the internet and other networks, report the incident to their IT or security team, and preserve messages, attachment details, timestamps and system logs as evidence. They should not reopen suspicious files.
National CERT has also called on organisations to use approved secure platforms for sensitive government information and promptly report suspected incidents through its official reporting portal or designated CERT channels.
