NCERT issues high alert over WhatsApp cyber threats

Pakistan’s National Cyber Emergency Response Team (NCERT) has warned users of targeted phishing and malware

Pakistan’s National Cyber Emergency Response Team (NCERT) has warned users of targeted phishing and malware attacks involving WhatsApp Web, WhatsApp Desktop and email. The agency cautioned that opening malicious files could expose Windows systems to hackers and put confidential information at risk.

According to the advisory, cybercriminals are posing as government officials and departments to distribute infected files disguised as official documents. Once opened, these files could give attackers remote access to a computer, allowing them to steal passwords and obtain sensitive data.

The warning also highlights the possibility of hackers taking control of active WhatsApp Web sessions. Such access could allow them to impersonate users and send fraudulent messages to their contacts, potentially putting more people at risk.

NCERT has advised users to remain alert to unexpected messages and attachments, even when they arrive from familiar phone numbers. The appearance of an unknown device in WhatsApp’s linked devices list could also indicate that an account has been accessed without permission.

Officials who handle sensitive information have been advised to avoid using WhatsApp Web and WhatsApp Desktop on Windows computers. The agency has also urged users to end suspicious linked sessions immediately and verify unexpected messages through a separate, trusted communication channel before opening links or files.

The advisory further warns against sharing passwords, one-time passwords (OTPs) or account verification codes with others. Users should also avoid transferring files received through WhatsApp to official Windows computers unless their authenticity has been confirmed.

To reduce the risk of cyberattacks, NCERT has recommended keeping Windows, browsers and other software up to date. Users should also enable WhatsApp’s two-step verification feature and use two-factor authentication wherever available.

If a device is suspected of being compromised, users should disconnect it from the internet and other networks immediately. They should preserve relevant messages and system logs as evidence and avoid opening suspicious files again.

The advisory serves as a reminder that messages appearing to come from trusted contacts or government departments can also be used in cyberattacks.