Cybercriminals are exploiting hijacked WhatsApp accounts to distribute malware to computer users by sending seemingly legitimate work-related documents. Singapore police have warned the public about the scam, in which attackers impersonate trusted contacts such as friends, colleagues and supervisors to convince victims to open malicious files.
The warning was issued on November 2, 2026. Although no monetary losses had been reported at the time, authorities cautioned that victims could have their personal information stolen and their computers compromised.
How the WhatsApp Malware Scam Works
Victims receive WhatsApp messages from accounts belonging to people they know. These accounts have already been compromised by hackers, making the messages appear genuine.
The messages contain attachments disguised as routine business documents. Examples of suspicious file names identified by the police include:
- Invoice 2026-09-15.iso
- Statement of Account_54d3.zip
- Salary Revision.rar
Recipients are asked to open these files on their computers, supposedly to review work documents. In some cases, they are instructed to forward the attachments to finance managers.
Users accessing WhatsApp through its Desktop application or Web version are particularly at risk. Opening the malicious files can install malware directly onto their computers.
Malware Can Record Keystrokes and Capture Screenshots
Once installed, the malware can perform several activities that give attackers access to sensitive information and computer operations.
According to the police advisory, the malicious software can:
- Record keystrokes entered by users.
- Capture screenshots of computer activity.
- Communicate with external command-and-control servers.
- Enable cybercriminals to gain control of infected computers.
The attack can then spread further. Hackers may take over the victim’s WhatsApp account and use it to distribute the same malicious files to other contacts.
In some cases, compromised accounts are also used to request money from contacts under the pretext of borrowing funds.
Victims may discover the breach only after noticing unusual computer behaviour or receiving warnings from contacts who have received suspicious messages from their accounts.
No Financial Loss Reported, but Data Theft Remains a Risk
Singapore police said no monetary losses had been reported in connection with this particular scam when the advisory was issued. However, the possibility of personal information being stolen makes the campaign a significant cybersecurity concern.
The warning comes amid a broader rise in scam activity in Singapore. Police statistics showed that victims lost S$410.6 million to scams during the first half of 2026.
How to Protect Your WhatsApp Account and Computer
Authorities have recommended several precautions to prevent account takeovers and malware infections.
Users should enable WhatsApp’s two-step verification feature under Settings, Account and Two-Step Verification. They should also regularly review the Linked Devices section and log out of any unfamiliar devices.
Most importantly, users should avoid opening unexpected attachments, even when they appear to come from trusted contacts. Any suspicious request should first be verified through a separate channel, such as a phone call.
Singapore police have also recommended installing the ScamShield application and using banking security features such as Money Lock.
The incident highlights how cybercriminals are exploiting trust between people to spread malware. A message from a familiar WhatsApp contact should not automatically be considered safe, particularly when it contains an unexpected document asking to be opened on a computer.