--- title: "M’sians Warned Not To Open Suspicious WhatsApp ZIP Files, Even From Friends" url: https://weirdkaya.com/msians-warned-not-to-open-suspicious-whatsapp-zip-files-even-from-friends/ date: 2026-11-05 modified: 2026-11-05 lang: en author: "Jann Firdaus" description: "Getting a document from someone you know on WhatsApp might not seem unusual, especially when it looks like something work related. But if the message asks you to open a..." categories: - "Society" tags: - "Hacker" - "malware" - "top files" - "virus" - "WhatsApp" image: https://cdn.weirdkaya.com/media/Msians-Warned-Not-To-Open-Suspicious-WhatsApp-ZIP-Files-Even-From-Friends.png word_count: 719 --- # M’sians Warned Not To Open Suspicious WhatsApp ZIP Files, Even From Friends **Getting a document from someone you know on WhatsApp might not seem unusual, especially when it looks like something work related.** But if the message asks you to open a ZIP file on your computer and forward it to your finance manager, pause before doing so. A warning shared on Threads has drawn attention to suspicious WhatsApp attachments, with several users claiming they or their workplaces had received similar messages. ## Asked to open the file on a computer ![M’sians Warned Not To Open Suspicious WhatsApp ZIP Files, Even From Friends,](https://weirdkaya.com/wp-content/uploads/Msians-Warned-Not-To-Open-Suspicious-WhatsApp-ZIP-Files-Even-From-Friends-1.jpg)Photo via Threads/**[@pelabur_bijak](https://www.threads.com/share/JG0n-Jcya)** In the screenshots shared by Threads user **[@pelabur_bijak](https://www.threads.com/share/JG0n-Jcya)**, a WhatsApp message contained a 3.5MB ZIP attachment named **“SOA(4)_5288.zip”**. The accompanying message asked the recipient to forward the document to their company’s finance manager for verification. It also instructed them to open it on a computer, supposedly to ensure the document could be displayed completely. The Threads user urged people to check with the sender before downloading or opening unexpected files, even when they appear to come from a close friend. ## Others share similar experiences In the comments, one user claimed their company had issued an internal memo after a staff member clicked on a similar attachment. ![Pixelated office meeting with blank wall](https://weirdkaya.com/wp-content/uploads/Pixelated-office-meeting-with-blank-wall.png)For illustration purposes only. Another shared a screenshot of a WhatsApp conversation featuring a ZIP file labelled as an invoice, along with instructions to forward it to a finance manager and open it on a computer. The sender later warned the recipient not to open it. However, the recipient replied that they had already opened and saved the file. These comments describe users’ experiences, but do not independently establish whether their devices were infected. ## MyCERT has confirmed a matching malware campaign The concern goes beyond the viral post. According to an [advisory issued by the Malaysia Computer Emergency Response Team (MyCERT) on October 29, 2026](https://mycert.org.my/portal/advisory?id=MA-1493.102026), an active malware campaign has been distributing ZIP attachments disguised as invoices, statements of account and other financial documents. The files were commonly distributed through WhatsApp, sometimes from a contact’s potentially compromised account or someone posing as a business contact. Recipients were instructed to open or extract the files on a computer, matching the approach shown in the viral screenshots. ## Running the hidden program can give attackers access According to the same MyCERT advisory, the infection process in the analysed cases involves a user opening the archive and running a program hidden inside it. That program can install a backdoor or an abused remote management tool, allowing attackers to control the affected Windows computer. **Receiving a message or downloading an attachment alone does not establish that a device has been infected.** The documented attack involves running the embedded program. However, users should avoid opening suspicious attachments to investigate them themselves. MyCERT warned that an infected computer could expose users to account takeover and financial fraud. Simply deleting the original attachment may not remove the infection. ## Don’t rely on fixes shared in the comments One comment advised users to uninstall a program called ManageEngine UEMS Agent, claiming the attack would happen after six or seven days. **However, the official advisories reviewed do not establish a fixed six or seven day timeline.** ManageEngine UEMS is also legitimate IT management software that attackers have abused in some cases, as described in [MyCERT’s findings](https://mycert.org.my/portal/advisory?id=MA-1493.102026). Finding it on a company computer does not automatically mean the device is infected, as an employer’s IT team may have installed it legitimately. Staff should check with their IT team before making changes. ## What users should do ![Colleagues reviewing a suspicious attachment](https://weirdkaya.com/wp-content/uploads/Colleagues-reviewing-a-suspicious-attachment.png)For illustration purposes only. An [MCMC security notice published on MKN’s website on November 4, 2026](https://www.mkn.gov.my/web/ms/2026/11/04/notis-keselamatan-mcmc-amaran-penipuan-melibatkan-fail-zip-dan-lampiran-mencurigakan-di-aplikasi-whatsapp/) also warned about suspicious ZIP files, attachments and links circulating through WhatsApp. Users are advised to: - **Verify unexpected attachments with the sender through a trusted channel, such as a phone call.** - **Avoid downloading, extracting or running suspicious files.** - **Enable WhatsApp’s two-step verification.** - **Check Linked Devices and remove any unfamiliar devices.** - **Keep their operating systems, apps and security software updated.** If a suspicious file has already been run and the device may be compromised, disconnect it from the internet, seek IT assistance and run a security scan. Change relevant passwords using another trusted device. Users should also alert their contacts if their WhatsApp account may have been compromised, so others do not fall for messages sent through it. Even when a file comes from someone you know, a quick call to check could save you a lot of trouble. **[READ ALSO:](https://weirdkaya.com/mahb-system-hacked/)** https://weirdkaya.com/mahb-system-hacked/ --- ![Check Us out at WhatsApp now!](https://cdn.weirdkaya.com/media/cta-whatsapp-v2.jpg)Join us at [WhatsApp ](https://bit.ly/WhatsAppWeirdKaya)now! ---