A WhatsApp attachment sent by someone you know may look like an ordinary work document, but opening the wrong ZIP file could expose your computer to malware and potentially allow hackers to take control of it.
Malaysians are being urged to be cautious of suspicious attachments, particularly messages asking recipients to open ZIP files on their computers and forward them to their company’s finance department.
The warning gained attention after a Threads user, @pelabur_bijak, shared screenshots of a WhatsApp message containing a 3.5MB ZIP attachment named “SOA(4)_5288.zip”.
The message instructed the recipient to forward the file to their company’s finance manager for verification and open it on a computer to ensure the document could be viewed in full.
The user advised people to verify unexpected attachments with the sender before downloading or opening them, even if the message appears to come from a close friend.
Several others shared similar experiences in the comments.
One user claimed their company had issued an internal memo after a staff member clicked on a similar attachment.
Another posted a screenshot of a WhatsApp conversation involving a ZIP file labelled as an invoice, accompanied by instructions to forward it to a finance manager and open it on a computer.
Although the sender later warned the recipient against opening the file, the recipient said they had already opened and saved it.
These accounts, however, do not independently confirm whether the devices involved were infected.
The concern is backed by a warning from the Malaysia Computer Emergency Response Team (MyCERT), which issued an advisory on Oct 29, 2026, about an active malware campaign involving ZIP files disguised as invoices, statements of account and other financial documents.
According to MyCERT, the files are commonly distributed through WhatsApp, sometimes from potentially compromised accounts belonging to existing contacts or people impersonating business associates.
The instructions to open or extract the files on a computer also match the method highlighted in the viral screenshots.
In cases analysed by MyCERT, the infection occurs when recipients open the ZIP archive and run a programme concealed inside it.
The programme can install a backdoor or exploit a remote management tool, potentially giving attackers control over the affected Windows computer.
MyCERT cautioned that an infected device could expose users to account takeovers and financial fraud. Simply deleting the original attachment may not remove the malware.
However, receiving a suspicious message or downloading an attachment alone does not mean a device has been infected. The documented attack involves running the programme contained in the archive.
Users have also been warned against relying on unverified advice circulating online.
One comment suggested uninstalling a programme called ManageEngine UEMS Agent, claiming the attack would occur after six or seven days.
However, official advisories have not established any fixed six or seven-day infection timeline.
ManageEngine UEMS is legitimate IT management software that has been abused in some cases, according to MyCERT. Its presence on a company computer does not automatically indicate an infection, as an organisation’s IT department may have installed it for legitimate purposes.
Employees should therefore consult their IT department before removing or changing any software on their work computers.
The Malaysian Communications and Multimedia Commission (MCMC) also issued a security notice on Nov 4, 2026, warning about scams involving suspicious ZIP files, attachments and links circulating on WhatsApp.
Among the recommended precautions are verifying unexpected files directly with the sender through a trusted channel, avoiding suspicious downloads and not extracting or running unfamiliar programmes.
Users should also enable WhatsApp’s two-step verification, review their Linked Devices and remove any unfamiliar devices, while keeping their operating systems, applications and security software updated.
Anyone who has already run a suspicious programme and suspects their computer may be compromised should disconnect it from the internet, seek assistance from their IT team and perform a security scan.
They should also change relevant passwords using another trusted device.
If a WhatsApp account is suspected to have been compromised, users should alert their contacts to prevent others from falling victim to messages sent through the account.
A simple phone call to verify an unexpected attachment could help prevent a potentially costly cybersecurity incident.
