Delete Immediately – These .EXE Files on WhatsApp Are Stealing Accounts

If you use WhatsApp on your laptop or desktop, this is a must-read. The Indian Cyber Crime Coordination Centre (I4C), under the Home Ministry, has issued a high-priority alert for WhatsApp users. Cyber criminals are now using .EXE and .DLL files to hijack accounts and compromise computers.

How the Scam Works

Hackers are moving beyond basic phishing links. They’re now sending executable files disguised as regular documents – think “Invoice.pdf.exe” or hidden executables inside ZIP folders. The moment you open it on a Windows computer, malware activates in the background. Most users don’t even realize something’s wrong because the system continues to appear normal.

How WhatsApp Gets Hacked

The malware specifically targets session tokens stored on the Windows system for WhatsApp Desktop and WhatsApp Web. Once attackers access these tokens, they can take over your account without needing an OTP or re-login. They can then access your private chats, contacts, media, and sensitive documents. Some variants even log keystrokes, putting your banking passwords and other credentials at risk.

Also Read: No Internet? No Problem – UPI’s Offline Tap-to-Pay is Coming

Why Office Workers Are Prime Targets

This isn’t just about personal accounts. If an employee’s WhatsApp gets compromised, attackers can send fake messages to colleagues from a trusted number. It’s called a “Boss Scam” – where hackers impersonate senior executives and instruct finance teams to transfer funds. Because the message comes from a genuine WhatsApp account, the deception often works.

What CyberDost Recommends

• Never download or open unknown .EXE or .DLL files from any source.
• If you accidentally run one, disconnect your computer from the internet immediately and change passwords for all important accounts.
• Regularly check your WhatsApp’s Linked Devices section and log out any unknown devices.
• Enable Two-Step Verification in WhatsApp to prevent unauthorized re-registration.

What to Do If You’re a Victim

If your account is hacked or you face financial fraud, report it immediately at the National Cyber Crime Reporting Portal or call the cyber helpline at 1930. Early reporting increases the chances of tracking suspicious bank accounts and digital transactions. With messaging platforms becoming central to work life, these attacks are on the rise – a little caution can go a long way.