Beware of malware targeting computer users via hijacked WhatsApp accounts

SINGAPORE – Be on the alert for scams circulating on WhatsApp where computers are targeted via hijacked accounts belonging to friends, colleagues and bosses.

While no money has been reported lost to the scam yet, victims risk having their personal information stolen, the police warned in a statement on Nov 2.

In this scam variant, victims would receive seemingly legitimate or work-related file attachments – under file names such as “Invoice 2026-09-15.iso”, “Statement of Account_54d3.zip” or “Salary Revision.rar” – from contacts whose WhatsApp accounts had already been hacked.

The recipients would be told to open the files on a computer, typically under the pretext of reviewing work documents, or asked to forward them to finance managers.

Those using WhatsApp Desktop or Whatsapp Web who fell for the ruse would end up downloading the malware directly onto their computers.

Once the file was opened, the malicious software would be installed in the background and be able to record keystrokes, take screenshots, as well as communicate with external hacker servers, essentially giving fraudsters the ability to control the victims’ computers.

These cyber attackers would then take over the victims’ WhatsApp accounts to distribute the same malware to other contacts or ask for money under the guise of borrowing funds.

Victims would only discover the breach after noticing abnormal behaviour on their device, or getting alerts from their WhatsApp contacts who received suspicious messages from them, the police said.

Scams remain the dominant crime type in Singapore, with $410.6 million lost to these ruses in the first half of 2026 alone.

Eight in 10 victims are still being manipulated into handing funds over to scammers, with seniors aged 65 and above suffering the highest losses on average across all age groups, police statistics show.

The public is urged by the police to enable two-step verification on WhatsApp, routinely disconnect unrecognised devices under “Linked Devices”, install ScamShield, and use bank “Money Lock” features.

Refrain from opening unexpected attachments, even from known contacts, without verifying the request via a phone call or separate channel first, the police said.

Anyone with doubts or scam-related queries should call the 24/7 ScamShield Helpline on 1799.