SingCERT warns of malware spreading through WhatsApp chats

End-to-end encryption keeps WhatsApp messages private on their way to you. It does not stop a friend whose account or computer is already compromised from sending you a bad file. On October 27, 2026, SingCERT, part of the Cyber Security Agency of Singapore (CSA), published an advisory about malware campaigns spreading through compromised WhatsApp accounts.

This is unrelated to the scheduled messages iOS beta and Restricted Chat beta notes from earlier this month. Those are product features. This one is a real infection path through ordinary chats.

What SingCERT reported

The SingCERT advisory says SingCERT has received multiple reports of malware campaigns involving malicious files sent through compromised WhatsApp accounts. The files may be disguised as legitimate-looking documents or other harmless attachments, and they work because you trust messages from people you know.

In reported cases, people who downloaded and opened those files later found that similar files had gone out to their contacts without their knowledge. That is how the campaign spreads: your account becomes the next trusted sender.

SingCERT says that, depending on the malware involved, attackers could:

• Gain unauthorized access to the affected device
• Steal sensitive information, including account passwords
• Hijack active WhatsApp Web sessions to send more malicious files to your contacts
• Monitor activity on the device, including online banking

Treat that as a list of possibilities, not a promise that every file does all of it. The practical rule is simpler: an unexpected file from someone you know is still untrusted until you check with them another way.

SingCERT’s advisory also points to similar reports in Malaysia. In September, The Star described ZIP files posing as PDFs arriving from trusted contacts, with instructions to open them on a PC. The file types SingCERT names (.exe, .iso, and .zip) are mostly a computer problem, so be especially careful when you use WhatsApp on a laptop or desktop.

What to do when a strange file arrives

1. Do not download or open it, even if it comes from family or a friend. SingCERT specifically warns about files ending in .exe, .iso, and .zip.
2. Check with the sender another way. SingCERT suggests a phone call. A text in a different app or a word in person also works. Do not rely only on the same WhatsApp chat, because that account may be the one that was taken over.
3. If you already opened the file: disconnect that computer or phone from the internet, scan it with reputable antivirus software, and tell your contacts that your account may be compromised and that they should not open files from you.
4. Check your linked devices in WhatsApp. On iPhone it is Settings > Linked Devices; on Android, tap the three-dot menu, then Linked devices. Log out of any computer, tablet, or browser you do not recognize. SingCERT names hijacked WhatsApp Web sessions as one way the malware keeps spreading.
5. Turn on two-step verification under Settings > Account > Two-step verification if it is not already on, and use WhatsApp’s official account recovery steps if your account was taken over. WhatsApp explains two-step verification and linking devices in its Help Center.
6. Stay off WhatsApp Web and other important accounts on a computer you think is infected until it has been cleaned. That is SingCERT’s advice too.
7. Keep your phone, computer, and WhatsApp updated from the official app stores and system updaters, and keep reputable antivirus running on your computers.
8. Report unauthorized bank transactions to your bank and the police right away if you see any.

Linked devices deserve a regular look

WhatsApp can stay signed in on a computer for a long time. That is convenient until it is not. After any scary attachment:

• Open your Linked devices list
• Remove old computers, tablets, and browsers you no longer use
• Link new devices yourself by scanning the QR code, not by clicking “log in” links that arrive in a chat

A clean linked devices list will not stop every piece of malware. It does cut off one path SingCERT flagged for mass-sending files to your contacts.

Why “but it’s encrypted” is the wrong comfort

People hear that WhatsApp is encrypted and assume attachments are safe. Encryption means no one in the middle can read the message. It does not mean the person (or the malware) on the other end is trustworthy. A compromised contact is still a contact. That is the whole trick.

The same habit applies to every messaging app. Treat unexpected programs, disk images, and mystery ZIP files as dangerous until proven otherwise, no matter which app delivered them.

Do this / don’t do that

Do

• Leave unexpected WhatsApp files unopened until you confirm with the sender by phone or another channel.
• Review your linked devices and turn on two-step verification.
• Warn your contacts quickly if you opened something suspicious.
• Keep WhatsApp, your phone, and your computer updated.

Don’t

• Don’t open .exe, .iso, or random .zip files from a chat just because the name looks like a bill, a receipt, or a photo.
• Don’t treat “it’s encrypted, so it’s fine” as malware advice.
• Don’t leave old WhatsApp Web sessions signed in on shared family computers.
• Don’t use this scare as a reason to install “WhatsApp cleaner” apps from outside the official stores.

Bottom line

SingCERT’s October 27, 2026 advisory describes malware spreading through compromised WhatsApp accounts that send malicious files to their contacts, including by hijacking WhatsApp Web sessions. Encryption does not check your friends’ attachments. If a file looks wrong, confirm with the sender another way, do not open it, check your linked devices, turn on two-step verification, and keep everything updated. If you already opened one, disconnect, scan, and warn your contacts before they open the next one.

Image: Official Cyber Security Agency of Singapore (CSA) logo on white, from the advisory page’s Open Graph art (csa.gov.sg).