National CERT Pakistan has released a high-risk cybersecurity advisory aimed at government officials, regulators and anyone handling sensitive information. The agency says attackers are running targeted malware and phishing attacks that exploit WhatsApp Web, WhatsApp Desktop and email on Windows machines.

High-Risk Threats & Attack Methods

The advisory rates the ongoing danger as high risk, noting that such attacks could cause serious operational impacts. Hackers may obtain remote access, steal credentials and exfiltrate confidential files.

Attackers can also hijack active WhatsApp Web sessions, allowing them to pose as legitimate users and target other organisations. They often impersonate trusted contacts or government departments and distribute malicious archives, scripts and executable files. Users typically become compromised by clicking malicious links or opening unsafe attachments.

National CERT listed possible indicators of compromise such as unexpected messages, unusual attachments, unknown linked devices and suspicious data transfers, but did not provide specific attacker domains or file hashes.

Immediate Actions for Protection Against WhatsApp Web Malware

The agency strongly recommends officials temporarily block WhatsApp Web and Desktop on official Windows computers and follow these steps:

  • Review the "Linked Devices" feature in your mobile app immediately.
  • Terminate any active or unauthorized web sessions.
  • Avoid transferring WhatsApp files to official computers via other channels.

Staff should verify any suspicious requests before opening them and never trust unexpected communications, even from known contacts. Passwords, OTPs or authentication codes must never be shared. Sensitive government messages should be sent only through approved secure platforms, while updated mobile apps remain acceptable for personal use where policy allows.

Strengthening Security Protocols

Organisations are urged to patch Windows systems, browsers and other critical software without delay, and to keep reputable endpoint detection and response (EDR) tools or anti-malware solutions active. IT teams should block unauthorized applications and scripts. All users must enable multi-factor authentication and WhatsApp two-step verification to protect accounts.

National CERT instructed government departments and designated focal persons to circulate the warning promptly. If a compromise is suspected, users should disconnect the affected Windows device from the internet, report the incident to their security team and preserve logs and suspicious messages. Security staff will then guide users to reset credentials from a clean, verified device.