WhatsApp Malware Hides in Work Files

A malicious WhatsApp attachment rarely looks malicious. It looks like an invoice, a statement of account, a salary revision, or a legal acknowledgment. That is why the messages now circulating in Malaysia are credible enough to work: they appear to come from lawyers, engineers, clients, or colleagues, and they ask the recipient to open a file on a computer.

Agencies and researchers have tracked it across Brazil, India, Singapore, Taiwan, Vietnam, the UK, and elsewhere. Malaysia is among the most visible targets. Kaspersky’s June 2026 study of a VBScript campaign found victims in several countries, with the highest number of observed victims in Malaysia. In September, The Star reported Malaysians receiving malicious ZIP files disguised as PDFs. MyCERT issued alerts in June and October. Singapore police warned about the same tradecraft on Nov. 2.

Several malware families share one trust chain: a compromised WhatsApp account sends a work-related file to its existing contacts, and the file executes on a Windows PC.

What the advisories actually found

Kaspersky’s June campaign used malicious .vbs files sent from compromised accounts. The file names looked like invoices, bank statements, payment records, and debt notices, and were localized in English, Portuguese, French, German, and Malay. Opening the file on Windows started a script chain that installed a legitimate remote monitoring and management tool, ManageEngine Endpoint Central, and pointed it at an attacker-controlled server. MyCERT’s June alert described the same pattern, including a lure named “Acknowledgment of Debt.vbs” and a Malay-language bill reminder. MyCERT stressed that the risk was confined to Windows: VBS files do not execute on iOS, Android, macOS, or Linux, and WhatsApp mobile apps do not process them as executable files.

The September wave changed the container. The Star reported Malaysians receiving ZIP files that looked like PDFs from trusted contacts, with instructions to open them on a PC. Trend Micro had reported similar cases in Brazil. The archive installed malware in the background and let the PC keep spreading the file through WhatsApp Web.

MyCERT’s October alert described a more developed version. The attachment was a password-protected ZIP or RAR containing a file named like a document, but actually a Windows virtual disk image (.iso or .vhdx). Mounting the image bypassed the “Mark of the Web” warning that normally follows a downloaded file. The image carried a signed executable that side-loaded a malicious DLL, installed a genuine ManageEngine UEMS agent, planted forged ManageEngine root certificates, and enrolled the device to an attacker-controlled server on TCP port 8383. MyCERT said it analysed three builds, corroborated by a Kaspersky register of 151 unique archive hashes, and assessed them as one operation. The lures were mostly banking e-statements.

Singapore police added a November variant with names such as “Invoice 2026-09-15.iso,” “Statement of Account_54d3.zip,” and “Salary Revision.rar.” The files arrived from hijacked friends’, colleagues’, or bosses’ accounts and were opened on WhatsApp Desktop or Web. The malware could record keystrokes, take screenshots, and contact attacker servers; the same accounts could spread the file further or ask contacts for money. No money loss was reported at the time.

Why a work file is the perfect lure

The warning message is right, but incomplete

The forwarded warning that is circulating is directionally correct. Do not open the file. Do not forward it. Delete it. But it misses the part that matters after a mistake. If the file has already been opened, deleting the WhatsApp message does not remove the implant. MyCERT’s guidance is to disconnect the device from the internet, change passwords from a clean device, treat every password and OTP typed on the infected machine as exposed, and get professional removal. A standard antivirus scan may not remove a legitimate remote-management agent that has been enrolled to an attacker’s server.

The warning calls the payload a “virus.” The observed campaigns are better described as malware loaders and remote-access tools. That distinction matters for cleanup: the implant can add a service and trusted certificates, and survive a simple uninstall.

What to do, in order

Do not open the attachment. Verify with the sender through a phone call or a different messaging app, not by replying in the same chat.
Do not forward the file. Share the warning, not the attachment. Forwarding gives the malware a new delivery path.
Report it in WhatsApp and to MyCERT through Cyber999. Include a screenshot, the sender’s number, and the timestamp.
If you already opened it, disconnect from the network, do not use that device for banking or password changes, and use a clean device to change passwords and enable two-step verification.
Check WhatsApp linked devices. Log out of sessions you do not recognise. Enable two-step verification and do not share the registration code.
Treat these file types as suspect: .vbs, .vbe, .js, .bat, .cmd, .ps1, .exe, .msi, .zip, .rar, .iso, .img, .vhd, and .vhdx. A document that arrives as a virtual disk image is not a document.
For organisations, inventory ManageEngine UEMS and Endpoint Central agents and verify where each one reports. MyCERT’s host indicators include a C:\kouren or C:\cool drop folder, forged CN=ManageEngineCA certificates, and outbound TCP 8383 connections. Blocking virtual disk image mounts from user-writable paths defeats this delivery method.

What is established, and what is not

Question	Status
Are malicious WhatsApp attachments a real, documented threat in Malaysia?	Yes. MyCERT issued alerts in June and October 2026; Kaspersky found Malaysia had the highest number of observed victims in its June campaign; The Star reported Malaysian ZIP cases in September.
Is this a WhatsApp zero-day?	Not established. The documented cases rely on compromised accounts and a user opening a file. No WhatsApp software vulnerability is described in the advisories reviewed.
Are the messages from lawyers and engineers part of one named campaign?	Not established. The profession is a trust hook. Attribution requires a sample from the specific message.
Who is behind the campaigns?	Unattributed. Kaspersky found Chinese-language traces and infrastructure overlap with earlier ValleyRAT and Gh0st RAT activity, but said the evidence was insufficient for high-confidence attribution. MyCERT says no confirmed link to a named group.
How are the WhatsApp accounts compromised?	Not fully established. Kaspersky said the exact method was unknown at the time of its June report. The spread is consistent with account takeover and linked-device abuse.
How many people in Malaysia have been hit?	No public total; Kaspersky’s “highest observed” figure is a research observation.

Bottom line

The warning that arrived on WhatsApp is an incomplete version of a real advisory. The important shift is that the payload no longer looks like a random attachment from a stranger. It looks like work from someone you know, which is exactly why it spreads. The defence is to verify unexpected files through a second channel and to treat the file type and the request as the risk ahead of the familiarity of the name on the message.