Malicious WhatsApp ZIP files can steal passwords, banking details, expert warns

KUALA LUMPUR: Suspicious ZIP files circulated through messaging platforms such as WhatsApp could expose users to malware that steals passwords, banking credentials and personal information, said an expert.

Deputy Dean (Academic and Technology) of the Malaysian Institute of Information Technology, Universiti Kuala Lumpur (UniKL MIIT), Dr Shafiza Mohd Shariff, said the malware could collect information stored on users' devices, including login credentials, and monitor their banking activities.

She said the malicious software could capture users' keystrokes, collect passwords and other login credentials, access information stored on their devices and monitor their activities, particularly those involving financial applications.

"They can also monitor your device usage, especially if it is financial, such as banking and so on. They will be able to capture your credentials," she said.

Shafiza said attackers could also divert Transaction Authorisation Code (TAC) numbers to their phones if users accessed applications that still relied on the verification method, potentially allowing them to receive the codes without users' knowledge.

She said many mobile phone users did not have antivirus software installed, leaving their devices more vulnerable to malicious attachments circulated through platforms such as WhatsApp and Telegram.

At the same time, she advised users to contact the sender to verify suspicious files and avoid downloading or opening attachments from unknown sources.

"You can call the person who sent (the files to) you and check with them. If it comes from somebody you do not know, do not download it or open it," she said.

She also recommended installing antivirus software on mobile devices and keeping it running in the background at all times to detect and quarantine malicious files.

On Oct 29, the Malaysia Computer Emergency Response Team (MyCERT) issued an advisory on an active campaign in Malaysia involving malicious files disguised as financial and payment documents and distributed through WhatsApp.

According to MyCERT, the files were disguised as invoices, statements of account, electronic statements and compiled payment documents, with recipients instructed to open or extract the ZIP attachments on a computer.

MyCERT said its analysis found that running the programmes embedded in the ZIP archives could install remote-control malware on Windows computers, potentially giving attackers control over affected devices.

Meanwhile, the Malaysian Communications and Multimedia Commission (MCMC), in a Nov 4 advisory, warned of increased risks involving suspicious ZIP files, attachments and links circulated through WhatsApp.

MCMC said scammers might impersonate known individuals or trusted parties to persuade recipients to open suspicious files or follow links, potentially resulting in malware infections, personal information leaks, unauthorised access to devices or WhatsApp accounts, and account takeovers. —BERNAMA