Singapore and Pakistan issue fresh cyber alerts as WhatsApp scams target accounts and web sessions

A separate risk flagged in the Pakistani advisory was the takeover of WhatsApp Web sessions. If a session is hijacked, an attacker can impersonate the account holder, exposing contacts and conversations and allowing further scams to spread through trusted chat threads.

Malware warnings focus on WhatsApp

The Singapore advisory described a pattern in which criminals gain control of a WhatsApp account and then use it to distribute malicious files to that person’s contacts. Because the message appears to come from someone known, recipients are more likely to click. The agency’s note did not specify the families of malware involved, but it framed the activity as an ongoing campaign rather than isolated incidents.

Pakistan’s alert placed particular emphasis on the way attackers are blending WhatsApp with more traditional phishing routes. The advisory warned that bogus official-looking messages can be used to deliver malicious files, especially to Windows users, and that the same operations may try to steal access to WhatsApp Web or desktop sessions.

The guidance urged officials handling sensitive information to avoid using WhatsApp Web and desktop applications on Windows systems. It also advised users to check linked devices for unfamiliar entries, a practical step that can reveal whether an account has been connected to an unknown computer.

WhatsApp supports multi-device use, allowing accounts to be linked to browsers and desktop apps. That convenience, however, creates another door that can be abused if a user is tricked into approving a link, or if an existing session is taken over.

SBI breach puts WhatsApp in spotlight

The cyber warnings landed as WhatsApp was also being cited in a separate dispute in India over how breach notifications are delivered.

The State Bank of India said on 23 October that it had individually informed 3,897 identified customers whose personally identifiable information appeared on the dark web earlier this month. The bank said those messages were sent through email and WhatsApp, after public pressure over the gap between market disclosures and customer communication.

Two digital-rights organisations, the Internet Freedom Foundation and SFLC.in, have pressed the bank to disclose exactly what it told affected customers and to confirm that all impacted people were notified and made whole. SBI has not publicly responded to those formal representations.

The episode has sharpened a familiar question for banks and other consumer-facing institutions: WhatsApp is fast and widely used, but messages can be missed, numbers can change, and criminals can exploit the same channel to impersonate brands. When the notification itself arrives in an app that is simultaneously being used for malware distribution and account takeovers, the burden shifts to customers to decide what is real.

A platform used for politics and abuse

WhatsApp’s scale and reach also mean it regularly shows up in stories far from cybersecurity.

In Brazil, reports describing the digital tactics behind President Luiz Inácio Lula da Silva’s election win have pointed to WhatsApp channels and broader social media efforts as part of a coordinated online push. The reporting described an operation that included outreach by younger influencer politicians and a deliberate focus on mobile-first communication.

In the United Kingdom, Jewish students have described antisemitic abuse that has moved through campus life and online spaces, including WhatsApp. The Union of Jewish Students told broadcasters that reports of antisemitic abuse against university students and staff have risen sharply since 2023, with a 14% increase recorded in the past year.

Taken together, the latest warnings and related developments underline WhatsApp’s dual role. It is designed as an end-to-end encrypted messaging and calling service, and it remains a default channel for family chats, office coordination and official outreach. At the same time, it is an attractive delivery mechanism for malware, a tempting target for session hijacking, and a conduit for political messaging and harassment.

What happens next will depend on user behaviour as much as platform controls. The Singapore and Pakistan advisories both point to the same weak link: trust. Once an attacker controls a real account or a real session, the message looks ordinary, and the damage can spread one click at a time.