WhatsApp ZIP & APK file scam: how it works

What happens

The president of the Malaysia Cyber Consumer Association (MCCA), Siraj Jalil, explained how it spreads in a Utusan Malaysia report (7 Nov 2026):

• Scammers pose as someone you know or a trusted party, sometimes using a number saved in your phone (possibly an old number that has changed hands) with a profile photo of someone you know.
• They send a ZIP, APK or attachment, asking you to "check it or take further action".
• If the file is opened, malware can be installed and gain access to the device, including reading OTP/TAC codes to move money (reported by Utusan).
• The WhatsApp account can be taken over and used to scam your contacts (MCMC).
• The file is then forwarded to family and WhatsApp groups, and keeps spreading because recipients trust the sender.

Warning signs

• A ZIP, APK or attachment from an unknown number, or from a contact but out of character for that person.
• A sudden request to "check" or "act on" a file.
• Offers of "free" apps (for example pirated streaming apps) as APK files.
• After opening a file: battery draining fast, phone running hot, SMS or OTPs not arriving, or alerts for transactions you didn't make (Utusan).
• Unknown devices in WhatsApp's "Linked Devices" list.

What to do

• Don't open, download or extract suspicious files. Verify with the sender through another channel (for example a phone call) first (MCMC).
• Turn off media auto-download in WhatsApp and enable Two-Step Verification. Never share your WhatsApp verification code or PIN.
• Check "Linked Devices" regularly and remove any you don't recognise. Install apps only from Google Play or the App Store.
• If you already opened one: disconnect from the internet, scan the device, change passwords from another safe device, and warn your contacts (MCMC).
• If you see transactions you didn't make, call your bank at once to block your card and online banking. If money has been lost, call NSRC on 997.

Sources