National CERT Pakistan has officially issued a high-risk cybersecurity advisory. The warning directly targets government officials, regulators, and sensitive-information handlers. Currently, attackers are launching targeted malware and phishing campaigns, specifically exploiting WhatsApp Web, WhatsApp Desktop, and email on Windows systems.
High-Risk Threats & Attack Methods
The official advisory from National CERT explicitly rates this ongoing threat as high risk. Consequently, these attacks can lead to severe operational consequences. Hackers could successfully gain remote access to systems, steal credentials, and exfiltrate confidential documents.
Additionally, attackers might expose and hijack active WhatsApp Web sessions. From there, they can easily impersonate legitimate users and target other organizations. Typically, these attackers impersonate trusted contacts or government departments. Then, they distribute malicious archives, scripts, and executable files. Unfortunately, users trigger the compromise simply by opening these malicious links or unsafe attachments.
National CERT identified several potential indicators of compromise, including unexpected messages, unusual attachments, unknown linked devices, and suspicious data transfers. However, the agency has not yet supplied specific attacker domains or file hashes.
Immediate Actions for Protection Against WhatsApp Web Malware
National CERT strongly urges officials to temporarily restrict WhatsApp Web and Desktop on official Windows computers. Officials must follow these steps to stay protected:
- Immediately review the “Linked Devices” feature on your mobile applications.
- Terminate all active or unauthorized web sessions.
- You must avoid transferring WhatsApp files to official computers through alternative channels.
Officials must independently verify any suspicious requests before opening them. Therefore, users should never automatically trust unexpected communications, even from known contacts. Furthermore, users must never share passwords, one-time passwords (OTPs), or authentication codes. For sensitive government communications, personnel should strictly use approved secure platforms. Alternatively, updated mobile applications remain acceptable for personal communication where security policies permit.
Strengthening Security Protocols
Organizations must immediately patch their Windows systems, browsers, and other critical software. Moreover, they need to maintain reputable endpoint detection and response (EDR) solutions or robust anti-malware systems. IT teams should proactively restrict unauthorized applications and scripts. Finally, all users must enable multi-factor authentication (MFA) and WhatsApp two-step verification to lock down account security.
National CERT directed government departments and designated focal persons to promptly disseminate this warning among their staff. If a suspected compromise occurs, users must immediately disconnect the affected Windows device from the internet. Afterward, they must report the incident to their respective security teams and preserve all system logs and suspicious messages. Security personnel will then guide affected users to safely reset their credentials from a verified clean device.
