Pakistan’s National Cyber Emergency Response Team (National CERT) has issued a high-risk advisory about targeted phishing and malware attacks carried out through WhatsApp Web, WhatsApp Desktop and email. The warning, reported on 26 October 2026, says attackers are impersonating government officials and departments, and sending malicious files disguised as official documents. If one of those files is opened on a Windows computer, it can infect the system, giving the attackers remote control, password theft and data theft. A hijacked WhatsApp Web session can then be used to impersonate the victim’s number and target more people.
Read that last part again, because it is what makes this advisory different from an ordinary scam warning. This is not only about one person losing a password. A compromised WhatsApp Web session lets the attacker send messages as you, from your number, to your contacts. Your friends, family and colleagues see a message from a number they trust, and they are far more likely to open the file attached to it. That is how one infection becomes many.
Before going further, one point must be stated plainly, because the advisory itself states it. This warning is aimed first at government officials and people who handle sensitive information. Officers dealing with sensitive material were specifically advised to avoid WhatsApp Web and WhatsApp Desktop on Windows computers. That does not mean everyone else can ignore it. The same checks described below protect anyone who uses WhatsApp Web, and the same tricks — a familiar name, an official-looking document, a file you were not expecting — work on ordinary users too. The advisory starts with officials, but its advice applies to everyone.
What the advisory actually warns about
The advisory describes targeted attacks, not random spam. The attackers pretend to be government officials or government departments, so the message looks like it comes from authority. The bait is usually a file made to look like an official document. On a phone screen, a document file with a government-sounding name can look entirely routine, which is exactly why it works.
The reported danger chain runs like this. First, the victim receives a message or email that appears to come from an official source. Second, the victim opens a malicious file disguised as an official document. Third, the file infects a Windows system, handing the attacker remote control of the computer, the ability to steal passwords, and the ability to steal data. Fourth, if the victim’s WhatsApp Web session is involved, the attacker can use that session to impersonate the victim’s number and send the same kind of malicious message to the victim’s contacts, starting the cycle again with fresh victims.
It is important to be precise about what this is and is not. The advisory describes phishing and malware delivered through WhatsApp Web, WhatsApp Desktop and email. It does not say that WhatsApp itself was breached or hacked. There is a big difference. A breach of WhatsApp would mean the app’s own systems were broken into. What is described here is criminals abusing the normal way WhatsApp Web works — a logged-in session on a computer — after tricking someone into opening a malicious file. Your defence, therefore, is not waiting for WhatsApp to fix something. It is checking your own sessions, your own files, and your own habits.
It is also worth keeping this warning separate from other recent alerts, because mixing them up leads to the wrong response. This is not the same as National CERT’s separate alert from 5–6 October about fake government websites, which warned about fake NADRA, FBR and FIA login domains. That was a different, older warning about phishing websites. This one is about files and sessions on WhatsApp Web and Desktop. And it is not the same as the general Linked Devices security checklist already on this site, which covers routine session hygiene; this article is about responding to this specific high-risk advisory. No specific malware name, attacker group or victim count was published in the sources for this advisory, and this article invents none of those details.
The warning signs the advisory names
National CERT’s own action list names two warning signs that should make you stop before you click anything. The first is an unexpected message or file from a known number. That sounds strange at first — if the number is known, why worry? Because a hijacked session sends messages from a real, trusted number. If a contact who never sends you documents suddenly sends you an official-looking file, or sends a file you were not expecting, that is itself a warning sign. The familiarity of the number is the trick, not proof that the file is safe.
The second warning sign is an unknown device in WhatsApp’s Linked Devices section. WhatsApp Web and Desktop work by linking a computer to your phone account. Every linked computer shows up in that list. If you see a device, browser or computer you do not recognise, treat it as a compromise until proven otherwise. Do not assume it is an old laptop you forgot about. Check it, and if you cannot account for it, remove it immediately.
Other signs fit the same pattern, even if they are not listed word for word in the advisory. A message that pressures you to open a file urgently, a document name that looks official but arrives without any context, a file type you were not expecting, or a contact whose writing style suddenly changes — all of these deserve a pause. The advisory’s core rule covers all of them: independently verify any unverified link, file or message before opening it. Verification means checking through a separate channel, not by replying to the same chat. Call the person on a number you already have, or contact the department through its official channel, and ask whether they really sent it.
Step by step: is my WhatsApp Web session safe?
This is the check the advisory points to, and it takes only a few minutes. Do it on your phone, not on the computer you are checking, because the phone is where the linked-devices list lives.
Step one: open WhatsApp on your phone, go to Settings, and open Linked Devices. You will see every computer and browser session currently linked to your account, along with the device type, browser and the time it was last active.
Step two: go through the list slowly, one entry at a time. For each entry, ask yourself whether you recognise it. A session on your own office computer or your own laptop, used recently, is expected. A session on a device you have never owned, a browser you never use, or a computer in a city you have never visited, is not.
Step three: if anything looks unfamiliar, log it out right away. WhatsApp lets you remove a single linked device from that list. Do not wait to investigate first and do not leave it connected while you think about it. Terminating a suspicious WhatsApp Web session immediately is exactly what the advisory advises, and logging out cuts off the attacker’s access through that session.
Step four: if you are unsure about an entry, log it out anyway. You can always link your own computer again in under a minute by scanning the QR code. The cost of wrongly removing your own session is a minute of inconvenience. The cost of leaving an attacker’s session connected is your contacts receiving malicious files in your name.
Step five: once the list is clean, check your recent chats for anything you did not send. If messages or files went out from your account that you do not recognise, your session may already have been misused, and you should move to the recovery steps below and warn your contacts.
Step six: turn on WhatsApp two-step verification if you have not already. This is a six-digit PIN that WhatsApp asks for when your number is registered on a new phone, and it is separate from the code sent by SMS. Open Settings, go to Account, tap Two-step verification, tap Turn on, and choose a PIN you will remember. Add an email address when asked, because that is how you recover the PIN if you forget it. This step does not remove an already-linked computer, but it makes it much harder for an attacker to take over your account itself.
Step seven: check the same list again in a few days, and make it a habit. A one-time check catches what is there today. A regular check catches anything that appears later.
What to do in the first 10 minutes if you opened a suspicious file
If you have already opened a file you now suspect, speed matters more than embarrassment. Do not waste time wondering whether it was really malicious. Act as if it was, because the cost of acting is small and the cost of waiting can be large. The advisory’s own instructions for a suspected compromise form the spine of this plan.
Minute one to two: stop and do not reopen the file or click any link inside it. The advisory is explicit on this point — do not reopen suspicious files or links. Closing the file does not undo an infection, but reopening it can make things worse, and clicking further links can download more malware.
Minute two to four: disconnect the suspected device from the network. Turn off its Wi-Fi or unplug its internet connection. This is the advisory’s first response step for a suspected device, and the reason is straightforward. Malware that cannot reach the internet cannot send your passwords and data to the attacker, and it cannot receive further instructions. Disconnect first, investigate second.
Minute four to six: on your phone, open WhatsApp’s Linked Devices section and log out every session you do not fully trust. If you are not sure which session is the problem, log out all of them. You can relink your own computers later. This stops the attacker from continuing to use your WhatsApp identity while you deal with the computer.
Minute six to eight: preserve the evidence before you delete anything. Keep the suspicious message, do not delete the chat, and keep any system logs you can. The advisory specifically says to preserve messages and system logs as evidence. Deleting the chat feels tidy, but it destroys the very record that investigators or your organisation’s IT team would need. Take screenshots of the message, the sender, the file name and the time it arrived, and keep them somewhere safe, away from the affected computer.
Minute eight to ten: change your most important passwords from a different, clean device — not from the suspected computer. Start with your email account, because email is the key to resetting almost everything else, then your banking and work accounts. Use strong, different passwords, and turn on two-factor authentication wherever it is offered. Two-factor authentication means that even a stolen password is not enough on its own, because the attacker would also need the second factor, such as a code from your phone.
After those ten minutes, the longer recovery begins. Run a full scan with updated antivirus software on the affected computer, and keep Windows, your browsers and your software updated — updates close the security holes that malware uses, and the advisory lists keeping software updated as a standing defence. If the computer belongs to your office or handles sensitive work, report the incident to your organisation’s IT or security team immediately and follow their instructions rather than trying to clean the machine yourself. And never share passwords, OTPs or verification codes with anyone who contacts you about the incident — no legitimate support team will ask for them, and anyone asking is part of the attack.
One more rule from the advisory deserves emphasis, because it is easy to get wrong. Do not transfer files received through WhatsApp onto official Windows computers. If a file arrives on your phone and you are not sure about it, moving it to a work computer does not make it safer — it moves the danger to the machine where the damage matters most. Keep unverified files off official computers entirely until they have been verified through an independent channel.
How to tell a real warning from a fake one
An advisory like this one creates its own second wave of scams, because criminals know people are now on alert. Expect fake messages claiming to be from National CERT, PTA, FIA or other authorities, warning about the very same threat and asking you to download a “security tool” or click a “verification link.” That is the same trick wearing a new uniform.
A genuine advisory is published by the authority itself and reported by established news outlets. It does not arrive as a WhatsApp forward asking you to install something. It does not ask for your password, OTP or verification code — ever. And it does not ask you to forward it to ten contacts. If a message about this alert asks you to download a file, share a code, or pay for protection, treat it as part of the attack, not as protection from it.
Protecting yourself day to day
The advisory’s defences are not complicated, and most of them are one-time setup tasks. Keep Windows, your browsers and all your software updated, and let automatic updates stay on. Use two-factor authentication on your email and important accounts, and keep WhatsApp two-step verification turned on. Never share passwords, OTPs or verification codes with anyone, including someone claiming to be from WhatsApp, your bank or a government department.
Be especially careful with files that claim to be official documents. A real government department that needs to send you a document will usually do so through an official channel you already know, and will be able to confirm it if you call them directly. If a document arrives out of nowhere on WhatsApp Web, by email, or from a contact who does not normally send you documents, verify it independently before opening it. That single habit — verify first, open second — defeats most of the attacks this advisory describes.
For people who handle sensitive information, the advisory goes further: avoid WhatsApp Web and WhatsApp Desktop on Windows computers altogether. That is a stricter rule than the general public needs, but its logic applies to everyone in a milder form. If a conversation or file is sensitive, keep it on your phone rather than opening it on a shared or office computer, and log out of WhatsApp Web when you are done instead of leaving the session running indefinitely.
Warning signs at a glance
| Warning sign | What it may mean | What to do |
|---|---|---|
| Unexpected file from a known contact | Their session may be hijacked | Do not open it; verify with the sender through another channel |
| Unknown device in Linked Devices | An attacker may hold a live session | Log out that session immediately |
| File disguised as an official document | Phishing or malware delivery | Verify independently before opening; never transfer it to an official Windows computer |
| Message pressuring urgent action | Social engineering to skip checks | Slow down; urgency is a tactic, not proof |
| Messages you did not send | Your session is being misused | Log out all sessions, warn contacts, change passwords from a clean device |
| Request for password, OTP or code | Attempted account takeover | Never share it; no legitimate team asks for it |
Quick checklist before you open another file
- Open Linked Devices on your phone and remove any session you do not recognise.
- Turn on WhatsApp two-step verification and two-factor authentication on your email and key accounts.
- Verify any unexpected link, file or message independently before opening it, through a separate channel.
- Never share passwords, OTPs or verification codes with anyone.
- Do not transfer WhatsApp files to official Windows computers, and avoid WhatsApp Web or Desktop on Windows computers if you handle sensitive information.
- Keep Windows, browsers and software updated.
- If you opened a suspicious file: disconnect from the internet, log out suspicious sessions, preserve messages and logs as evidence, do not reopen the file, and change key passwords from a clean device.
That checklist is the whole response in miniature. Check your sessions, verify before you open, and act fast if something slips through. The advisory is high-risk for a reason, but every step it asks for is something you can do today, in minutes, from your own phone.
This warning was reported by UrduPoint on 26 October 2026, and was also covered the same day by UrduPro and Times of Karachi. The details in this article — the impersonation tactic, the malicious-file method, the Windows infection risks, and the action list — come from that advisory as reported, and where the published sources are silent, such as on any specific malware name, attacker group or victim count, this article says so rather than guessing.
FAQs
Is WhatsApp itself hacked, according to this advisory?
No. The advisory describes phishing and malware delivered through WhatsApp Web, WhatsApp Desktop and email, not a breach of WhatsApp’s own systems. Attackers trick people into opening malicious files disguised as official documents, and a hijacked WhatsApp Web session is then used to impersonate the victim’s number. That is why the defence is checking your own linked devices and verifying files before opening them, rather than waiting for WhatsApp to fix something.
I only use WhatsApp on my phone, never WhatsApp Web. Am I safe from this threat?
You are safer from the session-hijack part of this threat, because there is no linked computer session for an attacker to abuse. But you are not fully safe, because the same phishing files can also arrive by email or in phone chats, and malicious files can target any device. The core habits still apply: verify unexpected files independently before opening them, never share passwords, OTPs or verification codes, and keep your phone’s software updated.
What should I do if I see a device in Linked Devices that I do not recognise?
Log it out immediately from the Linked Devices section on your phone, without waiting to investigate it first. If you are unsure about any entry, log it out anyway — you can relink your own computer in under a minute by scanning the QR code. Then check your recent chats for messages you did not send, turn on two-step verification if it is not already on, and warn your contacts if anything was sent from your account without your knowledge.
I opened a suspicious file on my Windows computer. What are the first things I must do?
Do not reopen the file or click any link inside it. Disconnect the computer from the internet right away, log out all suspicious WhatsApp Web sessions from your phone, and preserve the message and system logs as evidence instead of deleting the chat. Then change your most important passwords — starting with email — from a different, clean device, turn on two-factor authentication, run a full antivirus scan, and if the computer is a work machine or handles sensitive information, report the incident to your organisation’s IT or security team immediately.