MyCERT Warns of WhatsApp Malware in Malaysia

MyCERT Issues High-Risk Malware Warning for WhatsApp Web and Desktop Users in Malaysia

The Malaysia Computer Emergency Response Team (MyCERT), operating under the National Cyber Security Agency (NACSA), has issued a public advisory warning of a high-risk malware campaign specifically targeting WhatsApp Web and Desktop users in Malaysia. The malware, identified as a credential-stealing trojan, exploits phishing links disguised as official WhatsApp updates or voice message notifications. Once installed, it captures login credentials, session cookies, and two-factor authentication codes, allowing attackers to hijack accounts without the victim's knowledge. The advisory was published on the MyCERT website on 15 March 2026 and applies to all users of WhatsApp Web and Desktop applications in Malaysia.

Key Facts

What Is the Malware and How Does It Spread?

The malware is a credential-stealing trojan that targets WhatsApp Web and Desktop users by mimicking legitimate WhatsApp update prompts or voice message notifications. It spreads primarily through phishing links embedded in emails, social media posts, or direct messages that appear to come from trusted contacts. According to MyCERT, the malware is designed to extract login credentials, session tokens, and two-factor authentication codes from the victim's browser or desktop application. Once the user clicks the link and downloads a malicious file, the trojan executes in the background, capturing keystrokes and browser data. MyCERT confirmed that the malware has been observed in active campaigns targeting Malaysian users since early March 2026, with at least 47 reported incidents as of the advisory date.

"Users are advised to be vigilant of unsolicited messages that claim to be from WhatsApp or other trusted services, especially those that urge immediate action such as updating the application or verifying an account."

— MyCERT Advisory, 15 March 2026

What Are the Risks to Users?

The primary risk is unauthorized access to the victim's WhatsApp account, which can lead to identity theft, financial fraud, and further spread of malware to the victim's contacts. Attackers can use the hijacked account to impersonate the victim, request money from contacts, or extract sensitive personal and business information stored in chats. MyCERT rates the risk as "high" because the malware can bypass standard security measures such as SMS-based two-factor authentication by stealing session cookies. According to MyCERT's incident data, 62% of reported cases involved financial losses exceeding 1,000 Malaysian ringgit per victim, with an average recovery time of 14 days.

How Can Users Protect Themselves?

MyCERT recommends a multi-layered approach: enable two-factor authentication on WhatsApp, avoid clicking links in unsolicited messages, keep WhatsApp Web and Desktop applications updated to the latest version, and use reputable antivirus software with real-time scanning. Users should also regularly review active sessions in WhatsApp's settings and log out of any unrecognized devices. For organizations, MyCERT advises implementing endpoint detection and response (EDR) solutions and conducting phishing awareness training. MyCERT stated that users who followed these precautions reduced their risk of infection by 89% based on internal analysis of reported cases.

Who Is This Warning For?

This warning is specifically for individuals and organizations in Malaysia who use WhatsApp Web or WhatsApp Desktop on Windows or macOS. It is particularly relevant for small and medium enterprises (SMEs) that rely on WhatsApp for business communication, as well as frequent users of the web version. The advisory does not apply to the WhatsApp mobile app on Android or iOS, as the malware targets desktop browser and application environments. MyCERT noted that 78% of reported victims were using WhatsApp Web on Google Chrome, while 22% used the standalone desktop application.

Common Questions

Is my WhatsApp account at risk if I only use the mobile app?

No, the malware specifically targets WhatsApp Web and Desktop versions. Mobile app users are not affected by this particular campaign, but should still practice general security hygiene.

What should I do if I already clicked a suspicious link?

Immediately disconnect from the internet, run a full antivirus scan, change your WhatsApp password, and revoke all active sessions in WhatsApp settings. Report the incident to MyCERT via their online portal.

Does this malware affect WhatsApp Business accounts?

Yes, WhatsApp Business accounts using the Web or Desktop version are equally vulnerable. MyCERT advises business users to enable two-factor authentication and restrict access to authorized devices only.

Sources and Methodology

This article is based on the MyCERT advisory published on 15 March 2026, as reported by Lowyat.net (https://www.lowyat.net/2026/396842/mycert-high-risk-malware-whatsapp-web-desktop-malaysia/). Additional context was derived from MyCERT's official website and incident response guidelines. All statistics and quotes are attributed directly to MyCERT. No currency conversions were applied; figures are in Malaysian ringgit (MYR). This article was last updated on 16 March 2026.