The Cyber Security Authority (CSA) has issued a nationwide alert over a sophisticated malware campaign exploiting WhatsApp Web to spread a dangerous banking Trojan targeting Windows computer users.
According to the CSA, cybersecurity experts have uncovered a new attack that leverages the trust and widespread use of WhatsApp to distribute Astaroth malware, a powerful Trojan designed to steal sensitive financial and personal data.
How the WhatsApp Web Malware Attack Works
In its public advisory, the CSA explained that the attack begins when cybercriminals send malicious ZIP archive files to unsuspecting users via WhatsApp messages. These files are often disguised as legitimate documents or shared with convincing narratives to encourage victims to download and open them.
Once the ZIP file is extracted and the enclosed file is executed on a Windows device, the Astaroth banking Trojan is quietly installed without the user’s knowledge.
“Cybersecurity experts have discovered a new malware attack that uses WhatsApp Web on Windows computers to spread a dangerous banking malware called Astaroth,” the CSA stated.
Silent Account Hijacking and Rapid Spread
After installation, the malware takes control of WhatsApp Web sessions linked to the infected computer. It silently retrieves the victim’s contact list and automatically sends malicious messages to those contacts, allowing the malware to spread rapidly through trusted networks.
“The malware silently connects to WhatsApp Web, where it retrieves the victim’s contact list and automatically sends similar malicious messages to all contacts,” the CSA warned.
This self-propagating technique significantly increases the malware’s reach, as recipients are more likely to trust messages coming from known contacts.
Financial Data Theft and Cybercrime Risks
While spreading in the background, the Astaroth malware carries out extensive data-harvesting operations, with a strong focus on financial information. The CSA revealed that the malware is capable of stealing:
- Online banking login credentials
- One-time passwords (OTPs)
- Browser cookies
- Keystrokes and other sensitive data
The stolen information can be used to access bank accounts, commit financial fraud, and facilitate further cybercrime, posing a serious threat to individuals and businesses alike.
CSA Issues Safety Guidelines for WhatsApp Users
In response to the growing threat, the CSA has urged the public to take immediate precautions, including:
- Avoid downloading or opening ZIP files and unexpected attachments received via WhatsApp, even from known contacts
- Be cautious of messages urging urgent action or downloads, a common social engineering tactic
- Regularly review active WhatsApp Web sessions and log out of any unfamiliar connections
- Avoid staying logged in to WhatsApp Web on shared or public computers
- Keep Windows operating systems, browsers, and antivirus software fully updated
Reporting Cybersecurity Incidents
The CSA also reminded the public of its 24-hour Cybersecurity and Cybercrime Incident Reporting Point of Contact, encouraging victims and concerned users to report suspicious activity and seek professional guidance promptly.
As cybercriminals increasingly exploit trusted digital platforms, authorities stress that user awareness and caution remain the strongest first line of defense.
