Singapore Police: hijacked WhatsApp accounts send malware files like "Invoice 2026-09-15.iso" to contacts
Singapore Police warned on 2 November 2026 that hijacked WhatsApp accounts are sending malware files such as “Invoice 2026-09-15.iso” to contacts, which can log keystrokes and capture screenshots. No monetary losses had been reported.
- First reported
- Reports
- 1
Source: police.gov.sg · published
What happened
The Singapore Police Force issued an advisory on 2 November 2026 about a variant of malware-enabled scams in which malicious files are spread through WhatsApp to infect people's computers. The Police say no monetary losses had been reported to date, though victims may have had personal information stolen. Victims receive messages from compromised WhatsApp accounts of people they know, such as friends, colleagues or supervisors, containing attachments with seemingly legitimate or work-related names. Examples listed in the advisory are “Invoice 2026-09-15.iso”, “Statement of Account_54d3.zip” and “Salary Revision.rar”.
How the scam works
According to the advisory, victims are asked to open the attachment on a computer, typically on the pretext of viewing work documents, and in some cases to forward it to their finance managers. For people using WhatsApp Desktop or WhatsApp Web, the malware is downloaded directly to the computer. Once opened, it can log keystrokes, capture screenshots and communicate with an external command-and-control server.
In many cases the victims' own WhatsApp accounts were taken over and used to spread the same malware to their contacts. In some instances the compromised accounts were also used to ask the victims' contacts for money, on the pretext of borrowing funds. Victims may only notice when their device behaves abnormally or when contacts report suspicious messages sent from their account.
The Police recommend three steps. Add the ScamShield app, turn on Two-Step Verification in WhatsApp, check Linked Devices regularly and log out of any that you do not recognise, and use the Money Lock feature offered by banks. Check for scam signs with official sources such as the ScamShield app or the 24/7 helpline 1799, and do not open unexpected attachments even from known contacts, verifying with the sender by another channel such as a phone call. Tell authorities and loved ones, and if you suspect you have been scammed, contact your bank to block fraudulent transactions and lodge a police report.
Source
Singapore Police Force, “Police Advisory On Malware-Enabled Social Media Scams Leading To Compromise Of Personal Data On Computers”, 2 November 2026.
Red flags
- A WhatsApp message from a friend, colleague or supervisor with an unexpected attachment.
- File names that look like work documents, such as “Invoice 2026-09-15.iso” or “Salary Revision.rar”.
- A request to open the file on a computer or forward it to a finance manager.
- A WhatsApp account that suddenly sends the same file to many contacts or asks for money.
- A computer that behaves oddly after an attachment was opened.
If you were targeted
- 1Do not open unexpected attachments in WhatsApp, even from contacts you know.
- 2Check with the sender through another channel, such as a phone call, before opening a file.
- 3Turn on Two-Step Verification and check Linked Devices, logging out of any you do not recognise.
- 4Add the ScamShield app and use your bank's Money Lock feature.
- 5If you opened a file, contact your bank, lodge a police report and have the computer checked.