WhatsApp Web & Desktop Malware Alert for Windows: National CERT Advisory NCA-22.231026

National CERT Pakistan has issued advisory NCA-22.231026 warning of targeted phishing and malware spread through WhatsApp Web, WhatsApp Desktop and email, aimed at Windows computers. The risk is rated HIGH: infected systems can be remotely controlled, credentials and documents can be stolen, and active WhatsApp Web sessions can be hijacked to impersonate you. Here is what the advisory says and the practical steps to protect yourself and your business today.

Source: National CERT Pakistan advisory NCA-22.231026, published on pkcert.gov.pk/advisories. This article summarises the advisory; please read the original for official guidance.

What the Advisory Says

The advisory describes a targeted campaign against government officials and other high-value users. Attackers impersonate officials, departments or trusted contacts and send weaponised documents, archives, scripts or executable files. Once opened, these can give attackers persistent access to the Windows machine and to any WhatsApp Web session running on it. The advisory is preventive and states that campaign-specific indicators, such as confirmed attacker domains or file hashes, were not supplied.

Who Is Targeted

The stated scope is government bodies, regulators, public-sector organisations, senior officials and handlers of sensitive information. Even so, the techniques are common, so businesses and individuals who use WhatsApp Web or Desktop on Windows should treat this as a prompt to tighten their habits.

What Can Happen if a Device Is Compromised

• Unauthorised access, persistent malware and remote control of the Windows system
• Theft of credentials, confidential documents and communications
• WhatsApp hijacking, impersonation and further attacks on your contacts or organisation

Warning Signs to Look For

• Unexpected or urgent messages and unusual files, even from people you know
• Requests to enable macros or run scripts, and endpoint-security alerts
• Unknown devices in WhatsApp Linked Devices, messages you did not send, unusual logins or data transfers

The advisory lists example file names such as Official_Document_Update.exe and Urgent_Notice.iso. Treat unexpected executable files, ISO images and archives received over chat or email as suspicious, whatever they are called.

What to Do Right Now

1. Do not open unverified links or files. Confirm unusual requests with the sender through a separate channel, even if the message looks like it is from someone you trust.
2. Never share passwords, OTPs or authentication codes.
3. Review Linked Devices in WhatsApp on your phone and log out of anything you do not recognise.
4. Turn on WhatsApp two-step verification and enable multi-factor authentication on your other accounts.
5. Limit WhatsApp Web and Desktop on Windows. The advisory recommends that officials and sensitive-information handlers avoid them, and that organisations restrict them on official systems where policy allows. Do not transfer WhatsApp files to office computers through other channels.
6. Patch Windows, browsers and software, keep reputable anti-malware or EDR running, and do not enable unsolicited macros.
7. Brief your staff today, especially administrators and anyone handling sensitive data.

If You Think You Are Compromised

1. Disconnect the Windows device from the network and the internet.
2. From a trusted phone, end unauthorised WhatsApp sessions.
3. Preserve messages, attachment details, timestamps and logs. Do not reopen the suspicious content.
4. Report it to your IT or security team and to National CERT Pakistan via the incident reporting portal or at cert@pkcert.gov.pk.
5. Reset passwords from a verified clean device under your security team’s guidance.

Protect Your Website and Business Accounts Too

A hijacked computer can expose hosting, domain and email logins. Make sure you have recent backups (see our guide on how to back up your website), keep server software updated (read about the recent critical PHP security update), and review our website security basics. Edish also offers DDoS protection and network security services.

Frequently Asked Questions

What is National CERT advisory NCA-22.231026?

It is a high-severity preventive advisory from National CERT Pakistan warning of targeted phishing and malware delivered through WhatsApp Web, WhatsApp Desktop and email to Windows systems. Malicious files can enable remote access, credential theft and data exfiltration, and can expose active WhatsApp Web sessions.

Who is most at risk from this WhatsApp malware campaign?

The advisory says the targets are government bodies, regulators, public-sector organisations, senior officials and handlers of sensitive information. Anyone using WhatsApp Web or Desktop on Windows should still apply the same precautions.

How do I check if someone else is using my WhatsApp?

Open WhatsApp on your phone, go to Linked Devices, and log out of any session or device you do not recognise. Then turn on two-step verification.

What should I do if I opened a suspicious file?

Disconnect the Windows device from the network and internet, end unknown sessions from a trusted phone, preserve messages and logs without reopening the file, and report it to your IT or security team and to National CERT Pakistan.

Need help securing your hosting, email or website? Contact the Edish team.