KUALA LUMPUR, Nov 6 — Suspicious ZIP files circulated through messaging platforms such as WhatsApp could expose users to malware capable of stealing passwords, banking credentials and personal information, an expert has warned.
Universiti Kuala Lumpur Malaysian Institute of Information Technology (UniKL MIIT) deputy dean (academic and technology) Dr Shafiza Mohd Shariff said the malware could collect information stored on users' devices, including login credentials, and monitor their banking activities.
She said the malicious software could capture users' keystrokes, collect passwords and other login credentials, access information stored on their devices and monitor their activities, particularly those involving financial applications.
"They can also monitor your device usage, especially if it involves financial activities such as banking. They will be able to capture your credentials," she told Bernama.
Shafiza said attackers could also divert Transaction Authorisation Code (TAC) numbers to their own phones if users accessed applications that still relied on this verification method, potentially allowing them to receive the codes without users' knowledge.
She said many mobile phone users did not have antivirus software installed, leaving their devices more vulnerable to malicious attachments circulated through platforms such as WhatsApp and Telegram.
She advised users to contact senders to verify suspicious files and avoid downloading or opening attachments from unknown sources.
"You can call the person who sent you the files and check with them. If it comes from somebody you do not know, do not download or open it," she said.
She also recommended installing antivirus software on mobile devices and keeping it running in the background at all times to detect and quarantine malicious files.
On October 29, the Malaysia Computer Emergency Response Team (MyCERT) issued an advisory on an active campaign in Malaysia involving malicious files disguised as financial and payment documents distributed through WhatsApp.
According to MyCERT, the files were disguised as invoices, statements of account, electronic statements and compiled payment documents, with recipients instructed to open or extract the ZIP attachments on a computer.
MyCERT said its analysis found that running programmes embedded in the ZIP archives could install remote-control malware on Windows computers, potentially giving attackers control over affected devices.
Meanwhile, the Malaysian Communications and Multimedia Commission (MCMC), in a November 4 advisory, warned of increased risks involving suspicious ZIP files, attachments and links circulated through WhatsApp.
MCMC said scammers might impersonate known individuals or trusted parties to persuade recipients to open suspicious files or follow links, potentially resulting in malware infections, personal information leaks, unauthorised access to devices or WhatsApp accounts, and account takeovers.
