CERT-In Warns of a WhatsApp Malware Campaign: Here's What Every Business Should Know

WhatsApp has become an essential communication tool for businesses, employees, clients, and vendors. Whether it's sharing project updates, invoices, presentations, or quick documents, many organizations rely on WhatsApp Web and Desktop every day.

Unfortunately, cybercriminals know this too.

In a recent advisory, the Indian Computer Emergency Response Team (CERT-In) warned of a large-scale malware campaign targeting users of WhatsApp Web and WhatsApp Desktop. Unlike traditional phishing emails, this attack takes advantage of something people trust the most—messages from someone they already know.

It's a reminder that cybersecurity isn't only about firewalls and antivirus software. Sometimes, a single click on what appears to be an innocent attachment is all it takes for attackers to gain access to a device or even an entire business network.

What's Happening?

According to CERT-In, attackers are compromising WhatsApp accounts and using them to send malicious Visual Basic Script (.vbs) files to the victim's contacts. Because these files come from someone familiar—a colleague, customer, supplier, or even a friend—they don't immediately raise suspicion. When the attachment is opened, malicious code is executed on the user's computer, potentially giving cybercriminals access to the system. From there, attackers may steal login credentials, install additional malware, or move deeper into an organization's network.

Why This Matters for Businesses

For many businesses, WhatsApp has become an unofficial collaboration platform. Teams exchange quotations, invoices, project documents, contracts, customer information, and other sensitive business data every day. If just one employee unknowingly opens a malicious attachment, the consequences can be significant:

• Unauthorized access to company systems

• Stolen usernames and passwords

• Malware spreading across the corporate network

• Business downtime

• Financial losses

• Exposure of confidential customer data

• Damage to brand reputation

This isn't simply an IT issue anymore—it's a business risk.

How the Attack Works

The attack itself is surprisingly simple. First, a cybercriminal gains access to someone's WhatsApp account. Using that trusted account, they send a malicious attachment to people already in the contact list. Because the message appears genuine, recipients are more likely to download and open the file. Once executed, the malware can establish remote access, steal sensitive information, or install additional malicious software without the user's knowledge. It's a classic example of social engineering, where attackers exploit human trust rather than technical vulnerabilities.

CERT-In's Advice

CERT-In advises users to stay cautious when receiving files on WhatsApp, even if they come from someone they know. Avoid opening unexpected attachments without verifying them first. If you receive a suspicious file, it's always a good idea to call or message the sender separately to confirm they actually sent it. Be especially careful if the message seems unusual or out of character. Keeping your operating system and applications up to date, using reliable antivirus or endpoint security software, and regularly backing up important data are simple yet effective steps that can help protect your devices and reduce the risk of a malware attack.

The Bigger Picture

This advisory isn't really about WhatsApp. It's about how cyberattacks are changing. Today's attackers rarely rely on sophisticated hacking techniques alone. Instead, they exploit trust, curiosity, and routine business communication. Employees receive hundreds of messages every week. Attackers know people are busy, making it easier for a malicious attachment to blend into normal conversations. That's why organizations need more than technology—they need a culture of cybersecurity awareness.

How Businesses Can Reduce Their Risk

A proactive security strategy goes far beyond installing antivirus software.

Organizations should regularly:

• Conduct Vulnerability Assessment and Penetration Testing (VAPT)

• Review web, mobile, API, and network security

• Monitor endpoints for suspicious activity

• Train employees to recognize phishing and social engineering attacks

• Implement Multi-Factor Authentication (MFA)

• Maintain an incident response plan

• Apply security updates and patches promptly

Cybersecurity works best when people, processes, and technology work together.

Why CERT-In Compliance Matters

CERT-In regularly publishes advisories and cybersecurity guidance to help organizations respond to emerging threats. Following these recommendations helps businesses improve their overall security posture, strengthen incident readiness, and reduce the likelihood of successful cyberattacks. Regular security assessments and compliance reviews also help organizations identify weaknesses before cybercriminals do.

How GTIS Can Help

As a CERT-In Empanelled Information Security Auditing Organization, GTIS helps organizations strengthen their cybersecurity posture through independent security assessments and expert consulting services. Our team works with businesses across industries to identify vulnerabilities, assess cyber risks, and recommend practical security improvements.

GTIS offers a comprehensive range of cybersecurity services to help organizations identify vulnerabilities and strengthen their security posture. Our expertise includes Vulnerability Assessment and Penetration Testing (VAPT), Web, Mobile, and API Security Testing, Network and Infrastructure Security Assessments, Cloud Security Reviews, Information Security Audits, Risk Assessments, Security Awareness Training, and Compliance Support. By combining technical expertise with industry best practices, we help businesses proactively address security risks, improve resilience, and stay prepared for evolving cyber threats.

Rather than offering one-size-fits-all solutions, we work closely with organizations to build security strategies that align with their business objectives and evolving threat landscape.

Final Thoughts

The latest CERT-In advisory is another reminder that cyber threats continue to evolve—and attackers are increasingly targeting the people behind the technology. Before opening any unexpected attachment on WhatsApp, take a moment to verify it. That small step could prevent a major cybersecurity incident. For organizations, the lesson is equally clear: combine employee awareness with regular security assessments, strong endpoint protection, and proactive cybersecurity practices.

At GTIS, we're committed to helping organizations stay ahead of emerging threats. As a CERT-In Empanelled Information Security Auditing Organization, we help businesses identify vulnerabilities, strengthen security, and build long-term cyber resilience in an increasingly connected world.