The National Cyber Emergency Response Team (NCERT) has issued a high-severity WhatsApp Web cyberattack alert, warning of targeted phishing and malware attacks that arrive through WhatsApp Web, the WhatsApp desktop app and email.

Government officials and people who handle sensitive information are the main targets, according to the advisory. NCERT has rated the threat level as high.

How the attack works

The advisory says attackers pose as government officials and departments, then send harmful files to their targets. A file sent under the name of an official document can infect a Windows system when opened.

Phishing means tricking a person into opening a link or file, or giving up information, by pretending to be someone trustworthy. Malware is software designed to harm a device or steal from it.

If a system is compromised, NCERT says the risks include remote control of the device, password theft and data theft.

Why a message from a known number is not proof

The advisory raises a second risk, which is session hijacking. A WhatsApp Web session lets a computer use an account already logged in on a phone. If an attacker takes over that session, they could commit fraud from the victim’s own number.

For that reason, NCERT says an unexpected message or file from a number the recipient knows can itself be a sign of targeting. Another warning sign is an unfamiliar device in the “Linked Devices” list in WhatsApp.

What NCERT recommends

The advisory advises officers who hold sensitive information not to use WhatsApp Web or the desktop app on Windows. It also recommends that WhatsApp files not be moved onto official Windows computers.

For everyone, the recommendations are:

• End any suspicious WhatsApp Web sessions immediately.
• Do not open unverified links, files or messages. Confirm through a separate channel first.
• Never share passwords, one-time passwords (OTPs) or verification codes.
• Keep Windows, browsers and other software updated.
• Turn on two-factor authentication and WhatsApp’s two-step verification.

If a compromise is suspected, the device should be disconnected from the network and the internet at once. Messages and logs should be saved as evidence and not reopened.

Users can check their own account in WhatsApp under Settings, then Linked Devices. Any device they do not recognise should be removed.

Bottom Line

The advisory’s most notable instruction is also its most restrictive: officers with sensitive information should avoid WhatsApp Web and the desktop app on Windows altogether. That is a stronger step than the usual advice to be careful with links, and it suggests NCERT sees the risk as built into the setup and not just a matter of user mistakes.

WhatsApp is widely used for day-to-day work communication, including in offices. Messaging apps tend to feel informal, which lowers people’s guard, and a message from a familiar name carries a trust that email does not. Attackers who copy official names are using exactly that habit.

The practical test of the advisory will be whether departments turn it into written rules about which channels officials may use for official files. Warnings reach individuals, but only policy changes what a whole office does by default.