Crypto users warned as hackers spread dangerous malware via WhatsApp

Crypto users need to be extra careful with files they receive via WhatsApp. Cybercriminals are spreading malware through messages that look like ordinary invoices, bank statements and business documents. The dangerous part is that these messages can even come from friends, colleagues or other familiar contacts. The attacks mainly target Windows computers, where hackers may be able to steal passwords, personal data and access to crypto accounts.

Hackers abuse WhatsApp accounts in multiple countries

Security agencies in Malaysia and Singapore are warning about malware being spread via WhatsApp.

On 29 October, Malaysia’s MyCERT confirmed an active campaign in which criminals send malicious ZIP files. A day earlier, SingCERT warned about similar attacks via hacked WhatsApp accounts. On 2 November, the Singapore police followed with a warning of their own.

According to earlier research by Kaspersky, victims have been found in Brazil, Taiwan and Vietnam, among other places. These involve different campaigns and research periods, and not necessarily a single global attack.

The attackers take over WhatsApp accounts and then send infected files to existing contacts. Because the messages come from a familiar number, recipients are more likely to trust the file.

These files can be dangerous

The malware is often hidden inside compressed files or disguised programs. Think of a file named something like Invoice_October_2026.zip, Bank_Statement.zip or Invoice.pdf.exe.

The following file types in particular deserve extra attention:

• .zip and .rar: archives in which malicious programs can be hidden.

• .iso: disc image files that can contain malware.

• .exe: executable Windows programs that can launch malicious software directly.

• .lnk: Windows shortcuts that can be used to run dangerous commands.

An ordinary PDF, JPG or Office document generally poses a smaller risk, although these files too can be abused through vulnerabilities or misleading links.

Importantly, receiving a file is usually not enough to become infected. In the attacks described, the victim generally has to download a file, extract it and then run a malicious program first.

What does this mean for crypto users?

For crypto investors, attacks like these can have particularly unpleasant consequences.

An infected computer can give hackers access to stored passwords, browser data, screenshots and other sensitive information. That may also allow them to target crypto accounts.

Anyone using a software wallet should be especially cautious. Malware that steals recovery phrases or private keys can ultimately lead to the loss of cryptocoins.

The campaigns described mainly target Windows computers. A Windows program with the .exe extension cannot simply be run on an iPhone or Android phone. Smartphones are not fully protected against other forms of malware and phishing, however.

The most important precaution is simple: do not open unexpected files, even when they appear to come from someone you know.

Verify suspicious messages with the sender by phone, enable two-step verification for WhatsApp and regularly check which devices are linked to your account.

Also, never share your WhatsApp verification code, crypto recovery phrase or private keys.