WhatsApp Account Takeover Spike Triggers Alert Across Multiple Indian States

A rapid increase in WhatsApp account takeover incidents has been recorded in recent days, prompting alerts from the Ministry of Home Affairs. The surge was detected through the National Cyber Crime Reporting Portal, where complaints rose sharply as users reported unauthorized access to their accounts.

The attackers employ a trojan hidden inside zip archives that are presented as “Statement‑of‑Account.zip”, “RBI.zip” or “MCA.zip”. These files often carry a date in their name to increase credibility. When opened on a desktop or laptop, the trojan installs silently, hijacking the active WhatsApp Web session and enabling the criminal to send the same malicious file to all contacts.

States including Delhi, Gujarat, Maharashtra and Rajasthan have reported the highest number of cases. The coordinated response by I4C, which includes continuous monitoring and blocking of malicious servers, has so far shielded over 10,000 individuals.

The Ministry advises the public to treat any unsolicited zip attachment with suspicion, verify the sender through official channels, and report incidents via the cyber helpline 1930 or the official cybercrime website.