ISLAMABAD: Pakistan’s National Cyber Emergency Response Team (National CERT), also known as PKCERT, has warned government officials and other high-value users about phishing and malware attacks targeting Windows computers through WhatsApp Web, WhatsApp Desktop and email.
In advisory NCA-22.231026, the team said attackers were posing as government officials, departments or trusted contacts to trick users into opening malicious files or clicking harmful links. Once opened, these files or links could give attackers access to a computer, steal login details and expose sensitive information. They could also use an active WhatsApp Web session to impersonate the victim and target other people.
The advisory classifies the threat as high, warning that a successful attack could allow hackers to take control of systems, steal confidential documents and communications, and install malware that remains on a device. The attacks could also expose WhatsApp sessions and put other organisations at risk.
Government departments, regulators, public-sector organisations, senior officials and people who handle sensitive information have been identified as the main groups at risk.
The team has highlighted several warning signs, including unexpected messages or files from known contacts, requests to enable macros or run scripts, and unfamiliar devices appearing in WhatsApp’s Linked Devices list.
As a precaution, National CERT has advised officials and people handling sensitive information to avoid using WhatsApp Web and WhatsApp Desktop on Windows computers. Users should also check the Linked Devices section in their mobile app and immediately log out any suspicious sessions.
The advisory further recommends keeping Windows and other software updated, avoiding the transfer of WhatsApp files to official computers, enabling multi-factor authentication and WhatsApp two-step verification, and never sharing passwords, one-time passwords (OTPs) or authentication codes.
Users should not open suspicious links or files, even if they appear to come from someone they know. Any unusual request should be verified through a separate, trusted channel before taking action.
ALSO READ >>> RIC clarifies emergency services will continue without appointments
If a computer is suspected of being compromised, users should disconnect it from networks and the internet, preserve relevant evidence and report the incident to National CERT through its official reporting portal or email.
The advisory is preventive and does not include campaign-specific indicators of compromise. Further details are available on the PKCERT website.
