Authorities have uncovered a sophisticated malware campaign exploiting the trusted platform of WhatsApp Web to deliver a powerful banking Trojan targeting Windows users. The attack spreads through a malicious file shared via the messaging service, capable of silently hijacking a victim’s WhatsApp account to propagate itself and steal sensitive financial information. According to the Cyber Security Authority (CSA), experts have identified the malware as Astaroth, warning that criminals are leveraging the popularity and credibility of WhatsApp to deceive users into infection.
According to the alert, the attack begins with threat actors sending malicious ZIP archive files to potential victims via WhatsApp messages. These files are carefully disguised as legitimate documents or shared with convincing backstories to prompt users to download and open them. Once the enclosed file is extracted and executed on a Windows PC, the Astaroth malware is installed.
The infection takes a particularly dangerous turn once installed. According to the Cyber Security Authority (CSA), the malware covertly connects to WhatsApp Web, harvesting the victim’s contact list and automatically sending out malicious messages to all contacts—replicating itself without the user’s awareness.
This self-propagation through trusted contacts dramatically amplifies its reach and effectiveness. Meanwhile, the malware runs extensive background operations, targeting sensitive financial data such as banking credentials, one-time passwords (OTPs), browser cookies, and keystrokes. Stolen information can then be exploited to gain unauthorised access to accounts, commit fraud, and fuel further criminal activity.
In response, the CSA has issued urgent recommendations:
Be wary of messages urging immediate action or downloads, a hallmark of social engineering tactics.
Exercise extreme caution with ZIP files or unexpected attachments received via WhatsApp—even from familiar contacts.
To counter the WhatsApp Web hijacking, individuals should regularly check their active WhatsApp Web sessions and “log out of any you do not recognise,” while avoiding leaving sessions signed in on shared computers. Maintaining updated Windows operating systems and security software is also critical. The authority reminded the public of its 24-hour Cybersecurity/Cybercrime Incident Reporting Point of Contact for reporting incidents and seeking guidance.
Source: GraphicOnline
