Malaysia Warns Of WhatsApp ZIP Scams As Fake Documents Put Accounts And Devices At Risk

Malaysia's communications regulator has warned WhatsApp users to treat unexpected ZIP files, attachments and links with caution, highlighting a route through which impersonation can expose devices and accounts to compromise.

A Nov. 4 notice published by the National Security Council attributes the warning to the Malaysian Communications and Multimedia Commission. It says criminals may pose as familiar individuals or trusted organisations and ask recipients to review a file or take further action.

The concern is what the recipient is persuaded to open or run. The notice describes possible malware infection, disclosure of personal information and unauthorised access. A compromised account can then be misused to approach other people, extending the deception through an identity they recognise.

MCMC advises people to confirm unexpected requests through a trusted communications channel, avoid downloading, extracting or executing suspicious files, and keep their operating system and applications updated. The warning identifies potential risks; it does not say every ZIP archive is malicious or that receiving one by itself proves an account has been taken over.

A Familiar Contact Does Not Settle The Question

An earlier National Security Council notice in August had already drawn attention to dangerous files circulating through WhatsApp Web and Desktop. The latest alert gives households and small businesses a reason to apply the same verification habits to messages that arrive during ordinary work, including requests that appear to come from an existing contact.

Separately, MyCERT's current advisory index lists an Oct. 29 warning about fake financial documents distributed through WhatsApp delivering a Windows Trojan. The two notices should not be assumed to describe an identical campaign, but both put the authenticity of the document request at the centre of the recipient's decision.

For an employee handling invoices, confirming a request means checking the sender and purpose before opening the attachment. An expected business relationship is useful context; it is not proof that the particular file is safe. The same distinction applies to a family message forwarded from an account that may already be compromised.

MyCERT's detailed Oct. 29 advisory describes invoice and account-statement disguises that tell recipients to open a file on a computer. It advises against opening an archive containing an executable or a library file instead of the expected document. A genuine PDF does not require an embedded program. The advisory also warns against mounting unexpected virtual-disk files, which can conceal the same document-to-program deception.

Account Protection And Device Protection

WhatsApp's own security explanation identifies mobile-device malware as a threat that can use an account to send unwanted messages. Encryption of conversations and protection of the device are therefore different parts of security: a private communications channel does not make every item delivered through it trustworthy.

MCMC recommends enabling two-step verification, keeping verification codes and security credentials private, and regularly reviewing linked devices. Its notice says unfamiliar devices should be removed. These checks help users examine access to their account rather than relying solely on whether the most recent message looked convincing.

If a suspicious file has been executed and the device appears affected, the regulator advises disconnecting it from the internet, carrying out a security scan and changing relevant passwords using another trusted device. It also urges people to alert contacts if account compromise is suspected, reducing the chance that the same identity will be used against them.

MyCERT provides Cyber999 reporting channels for computer-security incidents. A clear report should distinguish a suspicious message from a file that was actually opened or run. Preserving that sequence helps explain what happened without turning suspicion into an unsupported claim about an attacker or the extent of a breach.