NCERT warns WhatsApp Web and desktop users in Pakistan of fake 'government document' malware

Pakistan's National Cyber Emergency Response Team (NCERT) has issued a high alert for people using WhatsApp Web and the WhatsApp desktop app, warning of phishing and malware campaigns in which attackers pose as government officials and departments, ARY News reported on 26 October.

How the attack works

• A message arrives on WhatsApp Web, the desktop app or by email, often from a number you recognise, with a file made to look like an official government document.
• Opening it on a Windows computer can install malware that gives the attacker remote control of the machine, along with saved passwords and sensitive files.
• The attacker can also take over your WhatsApp Web session and message your contacts as you, which is how the next victim gets a file from a "familiar" number.

The advisory says government officials and anyone handling sensitive information are the main targets, but the method works on anyone.

Warning signs

• A file or link you were not expecting, even from someone you know.
• An unfamiliar computer or browser in WhatsApp's Linked devices list.

What to do now

1. On your phone, open WhatsApp, tap the three dots (Android) or Settings (iPhone), then Linked devices. Log out of any device you do not recognise.
2. Turn on two-step verification (Settings, Account, Two-step verification) and set a PIN.
3. Verify an unexpected file by calling the sender before you open it.
4. Never share passwords, one-time codes or WhatsApp verification codes with anyone.
5. Keep Windows and your browser updated.
6. If you handle official work, NCERT advises against using WhatsApp Web or desktop on Windows at all, and against moving WhatsApp files onto office computers.

If you think you have been hit

NCERT's guidance is to disconnect the device from the internet and the office network, keep the messages and system logs as evidence, and not reopen the suspicious file. You can report cybercrime to the National Cyber Crime Investigation Agency.

Worried about SIMs issued on your CNIC that could be used for fraud? Our guide shows how to check the SIMs registered on your CNIC with 668.