AN estimated 32.3 million WhatsApp users in Malaysia could be exposed to cyberattacks involving malicious files designed to infiltrate smartphones, steal personal information and gain access to financial accounts.
The files, which may appear to be ordinary documents or application downloads, can contain malware capable of compromising a device without the user’s knowledge, leaving sensitive information vulnerable to theft.
The threat was highlighted by Malaysian Cyber Consumer Association (MCCA) president Siraj Jalil in an interview with Utusan Malaysia, which reported on the risks facing WhatsApp users.
Siraj said the widespread use of the messaging platform had made it an attractive target for cybercriminals, who could exploit users’ trust in messages and files received from familiar contacts.
He said files shared through WhatsApp could contain Android application package (APK) files, Trojan malware or spyware, allowing hackers to access information stored on a device or monitor its activities.
“Such software can threaten a user’s device, either by extracting data or monitoring activities on the phone.
“I have personally received files from numbers saved in my contacts, although the person may no longer be using that number.
“The WhatsApp profile picture belonged to someone I knew, but the file sent did not seem like something that person would share. I decided not to open it and deleted it immediately,” he said.
Siraj said the consequences could extend beyond the theft of personal information, with compromised devices potentially being used to carry out unauthorised financial transactions or spread malware to other users.
He warned that infected files could spread quickly when unsuspecting users forwarded them to family members or WhatsApp groups.
“When a file comes from someone familiar, we tend to trust it and open it. That is how malware or Trojan software can spread from one device to another.
“CyberSecurity Malaysia has also issued warnings about the risks of receiving suspicious files through WhatsApp,” he said.
Rather than panic, Siraj urged users to take basic precautions, starting with disabling automatic downloads on WhatsApp so that files are only downloaded when they choose to do so.
He also advised users to be cautious of messages from unfamiliar numbers, even when the sender’s profile picture appears to belong to someone they recognise.
Users should activate WhatsApp’s two-step verification, add an email address for account recovery and strengthen their account protection with additional security features.
Passkeys and biometric authentication on supported devices, as well as authentication applications such as Google Authenticator, can provide further protection.
Siraj said cybercriminals were often after information that could help them access victims’ financial accounts, including one-time passwords (OTPs) and transaction authorisation codes (TACs).
“They also want to take over applications on the device, particularly WhatsApp. Once they gain control, they can use the account to scam people in the victim’s contact list.
“They may also extract phone numbers, personal documents, photographs, files and information stored in notes before selling the data in bulk on the dark web,” he said.
In some cases, the malware could also be used for surveillance, with civil servants, journalists, media practitioners, community figures, celebrities and politicians among those who could be targeted.
Siraj also cautioned against using unfamiliar Wi-Fi networks and unsecured internet connections, even when offered free of charge.
He urged users to avoid downloading applications from unofficial sources, particularly pirated APK files promising free access to paid streaming services.
“Many Malaysians download pirated applications because they want to watch Netflix, Astro or Disney without paying. But these applications could be stealing their data.
“Offering free access is often just a way to get people to download the APK file. Users may think they are getting something for nothing, when in reality they are putting their devices at risk,” he said.
He also advised users to review the permissions granted to applications, particularly those involving access to their location, photo galleries and activity tracking.
Applications should only be given access to information necessary for their functions, while permissions that are no longer needed should be switched off.
“If an application does not need access to your photo gallery, do not allow it to access everything. Give it only the permissions necessary for its functions.
“Users need to take a little more care and understand what they are allowing these applications to access,” he said.
Warning signs that a phone may have been compromised include unusually fast battery drainage, overheating, malfunctioning features and problems receiving SMS messages.
Siraj said users should also be alert if they repeatedly requested an OTP but failed to receive it, as this could indicate a security problem.
Those who suspect their devices have been compromised should take steps to secure their accounts and consider restoring their phones to factory settings to remove malicious software.
Anyone who suspects their bank account has been compromised or has lost money to a scam should contact the National Scam Response Centre (NSRC) at 997 immediately.
Personal data breaches can also be reported to the Personal Data Protection Department, while suspicious financial transactions should be reported directly to the relevant bank.
“If you receive a notification for a transaction you did not make, contact your bank immediately and ask it to block your card and online banking access,” he said. – November 8, 2026
