CyberDost Issues Alert Over WhatsApp .EXE and .DLL File Malware Scam
In an urgent cyber advisory that highlights the evolving vulnerabilities of instant messaging platforms, CyberDost—the public awareness division of the Indian Cyber Crime Coordination Centre (I4C) under the Union Ministry of Home Affairs—issued a stark warning regarding malicious executable files targeting WhatsApp users. The threat campaign specifically targets individuals and enterprise staff accessing WhatsApp via desktop applications and web browsers on Windows operating systems. By distributing weaponised files carrying .exe and .dll extensions, cybercriminals are bypassing conventional network perimeters to gain total control over user endpoints and active messaging sessions.
The development represents a strategic shift in digital social engineering across the country, moving away from simple phishing links toward direct execution of malicious payloads. For security agencies and corporate IT administrators in New Delhi and regional industrial hubs, the campaign underscores how consumer messaging applications have become critical attack vectors for enterprise network breaches. The rapid adoption of hybrid work environments has blurred the boundary between personal communication tools and corporate infrastructure, creating fertile ground for stealthy intrusion.
The Mechanics of Session Hijacking and Payload Masking
The mechanics of the campaign rely heavily on double extensions and deceptive file formatting to manipulate user trust. Attackers routinely disguise executable files under misleading names such as “invoice.pdf.exe” or transmit compressed archive files containing paired executable binaries and Dynamic Link Libraries. When an unsuspecting user extracts and opens the attachment on a desktop system, the malicious script quietly executes in the background without triggering obvious visual alerts.
Once executed, the malware targets the local storage pathways of the Windows operating system where active session tokens for WhatsApp Web and WhatsApp Desktop reside. By extracting these active authentication tokens, the adversary gains immediate, persistent access to the victim’s account without requiring a secondary phone verification or One-Time Password. The compromise exposes private chat histories, stored contact lists, confidential documents, and media files to remote surveillance.
Furthermore, cybersecurity research teams have documented instances where malicious scripts drop renamed versions of system utilities into hidden directories to establish persistence. These background processes operate silently, allowing remote threat actors to execute secondary commands, capture keystrokes, and extract sensitive banking credentials. The ability to hijack an active messaging session while maintaining endpoint persistence transforms an individual infection into a broader corporate risk.
Corporate Threats and the Impersonation Cascade
The systemic risk posed by these executable payloads extends well beyond individual privacy loss. Recent advisories from the Securities and Exchange Board of India (SEBI) and national cybersecurity watchdogs highlight how compromised accounts are immediately weaponised to execute high-value financial fraud. Known colloquially as executive or “Boss Scams,” threat actors impersonate senior directors or regulatory officials to instruct finance personnel to transfer funds into mule bank accounts.
Because the fraudulent messages originate from legitimate, verified contact profiles, recipients are far less likely to question the authenticity of the request. The compromised account can also be used to automatically forward malicious archive files to hundreds of secondary contacts, creating a viral infection chain across organizations. This cascading effect enables cyber syndicates to extract significant sums in fraudulent wire transfers before defensive security measures can intervene.
Systemic Countermeasures and Operational Defence
Tackling this wave of executable malware requires a combination of strict endpoint security controls and disciplined user hygiene. Renowned cybercrime expert and former IPS officer Prof. Triveni Singh emphasized that executable and dynamic library components should never be treated as routine documents. He advised that if an unknown executable file is executed accidentally, the immediate priority must be disconnecting the device from local networks, auditing active web sessions, and changing critical account passwords.
The Central Government continues to urge citizens and corporate entities to enforce Software Restriction Policies on enterprise endpoints to block unauthorized .exe and .dll executions originating from user profiles. System administrators are advised to routinely audit active connections via the Linked Devices menu in WhatsApp settings and immediately terminate unfamiliar web sessions. Enabling Two-Step Verification provides an additional layer of security against unauthorized re-registration attempts.
In instances where financial loss or account compromise occurs, prompt reporting to the National Cyber Crime Reporting Portal or the 1930 Cyber Helpline remains essential. Swift intervention during the initial post-compromise window enables law enforcement agencies to track digital transaction trails and freeze fraudulent beneficiary accounts. As messaging platforms increasingly serve as primary productivity tools, hardening endpoint security against executable threats remains a fundamental pillar of national cyber resilience.
