Malaysians are being urged not to open unexpected ZIP files received on WhatsApp, even when they appear to come from friends or business contacts, as a malware campaign disguised as financial documents continues to circulate.
The Malaysia Computer Emergency Response Team (MyCERT) has said attackers are sending ZIP attachments posing as invoices, statements of account and other financial documents. The files are often sent from a contact’s compromised WhatsApp account or by someone posing as a business contact, with instructions to open or extract them on a computer.
Messages shared widely on social media follow the same pattern. One carried a ZIP file labelled as a statement of account and asked the recipient to forward it to the company’s finance manager, and to open it on a computer so the document would display properly. Several users said their workplaces had received similar messages.
According to MyCERT, a computer is infected when a user opens the archive and runs a program hidden inside it. The program can install a backdoor or a misused remote management tool that lets attackers control the Windows computer, exposing victims to account takeovers and financial fraud. Deleting the original attachment may not remove the infection.
The Malaysian Communications and Multimedia Commission (MCMC) has also warned about suspicious ZIP files, attachments and links spreading through WhatsApp.
Users are advised to confirm unexpected attachments with the sender by phone, avoid downloading or running suspicious files, turn on WhatsApp’s two-step verification and remove unfamiliar devices from the Linked Devices list. Anyone who has already run such a file should disconnect the computer from the internet, get IT help, run a security scan and change passwords using another device.