Pakistan issues high alert over WhatsApp Web and Desktop cyberattacks

ISLAMABAD: Before you open WhatsApp on your computer today, it may be worth pausing for a second — especially if you use WhatsApp Web or the desktop app. Pakistan’s National Cyber Emergency Response Team (NCERT) issued a high alert on Monday warning of targeted phishing and malware attacks carried out through WhatsApp Web, WhatsApp Desktop and email.

According to the advisory, attackers are impersonating government officials and departments to send malicious files dressed up as official documents. Once such a file is opened, a Windows system can be compromised — and from there, the attackers may gain remote access, steal passwords and extract sensitive data. The danger does not stop at one machine: if a WhatsApp Web session is hijacked, the attackers can send fraudulent messages to the victim’s contacts from the victim’s own number.

How to tell you are being targeted

NCERT flagged two warning signs in particular. The first is an unexpected message or file arriving from a familiar number. The second is an unfamiliar device showing up in WhatsApp’s linked devices list. In either case, the sender’s identity should be verified independently before anything is opened — even when the message appears to come from someone you know.

Special instructions for officials

Government officials who handle sensitive information have been urged to avoid using WhatsApp Web and WhatsApp Desktop on Windows systems for now, to terminate any suspicious WhatsApp Web session immediately, and not to transfer files received through WhatsApp onto official Windows computers. The advisory repeats a basic rule: never share passwords, one-time passwords or verification codes with anyone.

The same advice applies to ordinary users. Keep Windows, browsers and other software updated, and switch on two-factor authentication and WhatsApp’s two-step verification. And if a compromise is suspected, disconnect the affected device from the internet at once, preserve the relevant messages and system logs as evidence, and do not reopen the suspicious file — a hasty clean-up can also wipe out the evidence an investigation needs.