Pakistan’s National CERT has issued a high-risk cybersecurity warning over WhatsApp Web malware campaigns aimed at government officials, regulators, and people who handle sensitive information. The agency says attackers are running targeted malware and phishing operations that abuse WhatsApp Web, WhatsApp Desktop, and email on Windows computers.
National CERT (the Computer Emergency Response Team that coordinates cyber defence guidance in Pakistan) rates the ongoing threat as high risk. Successful attacks, it warns, can give hackers remote access to systems, steal login credentials, and copy confidential documents. Attackers may also take over active WhatsApp Web sessions, then impersonate the real user and contact other organisations.
How the attacks work
According to the advisory, attackers often pose as trusted contacts or government departments. They send malicious archives, scripts, and executable files. Opening unsafe links or attachments is enough to trigger a compromise.
National CERT lists possible warning signs: unexpected messages, unusual attachments, unknown linked devices, and suspicious data transfers. It has not yet published specific attacker domains or file hashes, so users cannot rely on a simple block-list of known bad files.
What officials are being asked to do
National CERT strongly urges officials to temporarily restrict WhatsApp Web and Desktop on official Windows computers. It also tells users to review the Linked Devices feature on their mobile apps, end all active or unauthorised web sessions, and avoid moving WhatsApp files onto official computers through other channels.
Staff should verify any suspicious request before opening it and should not automatically trust unexpected messages, even from known contacts. Passwords, one-time passwords (OTPs), and authentication codes must not be shared. For sensitive government work, personnel should use approved secure platforms; updated mobile apps may still be used for personal chat where policy allows.
Hardening systems and reporting incidents
Organisations are told to patch Windows systems, browsers, and other critical software without delay, and to keep reputable endpoint detection and response (EDR) tools or strong anti-malware in place. IT teams should block unauthorised applications and scripts. Users should turn on multi-factor authentication (MFA) and WhatsApp two-step verification.
National CERT directed departments and designated focal persons to share the warning with staff. If a compromise is suspected, the affected Windows device should be disconnected from the internet at once. The incident must be reported to the relevant security team, and system logs plus suspicious messages preserved. Security staff should then help reset credentials from a verified clean device.
Aasan alfaaz mein
National CERT ne hukoomati ahakaam ko WhatsApp Web malware ke khilaf high-risk warning di hai. Hamle Windows pe WhatsApp Web, Desktop aur email ke zariye ho sakte hain. Official computers pe WhatsApp Web/Desktop limit karein, Linked Devices check karein, aur suspicious links ya files na kholen. Agar shak ho to internet band karein aur apni security team ko bata dein.
