WhatsApp malware: a file from someone you know may still be unsafe
A message can come from someone you really know without actually being sent by them. Their account may be compromised, they may have been deceived or they may unknowingly forward a harmful file.
What did you actually do with the file?
Receiving a message is different from running a malicious app. Choose the situation that best matches what happened.
I only received the file
You received the message but did not download or open the file.
See the steps →I downloaded the file but did not open it
It is stored on the device but has not been run or installed.
See the steps →I installed an APK or app
Risk is higher, especially if the app received sensitive permissions.
See urgent steps →A friend’s account is sending messages
This is not necessarily device malware. Their WhatsApp account may have been taken over.
What this means →A file can come from an account you normally trust
The scammer need not use an unfamiliar number. Trust in a known contact can make someone open a file without normal checks.
A trusted-looking channel
The message comes from a familiar contact or convincing conversation.
An ordinary-looking message
“Have a look”, “Is this yours?”, “Invoice” or “Look at these photos”.
The file seems ordinary
It may look like a document, archive, image or app.
You trust the sender
A familiar name lowers caution and draws attention away from the file’s origin.
Installation or permissions follow
The page or file may ask you to install an APK and grant further access.
Malware gains access
Depending on the app, it may misuse data, notifications, SMS or other device functions.
What can arrive through WhatsApp
The extension alone does not establish safety. Consider the origin, whether you expected the file and what it asks you to do.
APK / installer
An Android installation package. An unexpected APK in chat is a strong reason to stop and verify.
ZIP / RAR
An archive can contain another document, script or executable file.
Document or PDF
It may contain a fraudulent link or prompt another social-engineering action.
Image or video
Usually a different risk from installing an app, but verify unexpected files and keep viewer software updated.
“But my friend sent it.”
Check the message, not only the sender’s name.
The account may be compromised
Someone else may be sending messages in your contact’s name.
Your contact may have been deceived
They may unknowingly be forwarding the file.
The message encourages forwarding
It may ask you to send it to more contacts.
Verification can be quick
Call the contact or ask through another independently trusted channel.
What should make you stop
Unexpected file
The sender provides an attachment without an explanation.
Installation package
You are asked to install an app directly from chat.
Archive with unknown contents
It is unclear what is inside.
“Allow installation from this source”
The instructions push you away from the normal trusted installation route.
Accessibility access
The app requests highly sensitive control over the device.
SMS access
An unfamiliar app wants to read or receive SMS messages.
Notification access
The app wants to read incoming notifications.
Pressure to open quickly
“Open it now”, “it’s important”, “confirm this for me”.
Four simple steps can interrupt the attack
Pause the automatic reaction
You do not have to open a file simply because a friend sent it.
Ask the sender
Verify the message by phone or another independent route.
Check the file type
APKs and unexpected archives deserve particular caution.
Do not install an app from chat
Obtain everyday apps from trusted official sources.
Strict Account Settings adds a stronger protective mode
WhatsApp introduced Strict Account Settings in 2026, especially for people facing sophisticated cyberattacks.
Blocking unknown attachments
The mode restricts attachments and media from people outside your contacts.
Limiting unknown contacts
It also applies stricter controls to communication with unknown people.
Stricter account configuration
Several privacy and security controls become more restrictive.
A compromised WhatsApp account is different from malware on a phone
A contact can send suspicious messages even without device malware. An attacker may have obtained account access another way.
Device-linking code
A scammer may persuade you to share a code for linking another device. Never share registration codes either.
Fraudulent QR code
Scanning it for a supposed competition or verification can link someone else’s device.
Unfamiliar linked device
The attacker can then access the account from another device.
Further scams against contacts
The familiar account may send files or requests for money.
What to do based on how far you got
Distinguish receiving a file, downloading it and actually installing an app.
I only received the file
- Do not open the file.
- Do not install any app from it.
- Verify the sender through another trusted channel.
- Preserve needed evidence, then delete or report the suspicious message.
- Do not forward the suspicious file to other contacts.
I downloaded the file but did not open it
- Do not run or install the file.
- Delete it if you cannot verify its origin.
- Do not allow installation from an unknown source.
- Check the device using its official security tools.
- On Android, check that Google Play Protect is active.
I installed an APK or suspicious app
- Stop using the app. Disconnect the suspect device from networks while securing accounts from another trusted device.
- Review and revoke sensitive permissions, including device-administrator access where applicable.
- Uninstall the suspicious app. If removal is blocked, seek trusted technical help.
- Use trusted security tools to check the device. A clean scan alone does not prove safety; confirmed infection may require a factory reset and careful setup from scratch.
- Review access to SMS, notifications and accessibility services.
- Update Android and other apps through official sources.
- Change important passwords from another trusted device if compromise is suspected.
I see unfamiliar activity or financial loss
- Do not use the suspect device for banking.
- Contact your bank immediately if money or banking access is at risk.
- Secure your main email and other important accounts.
- Review active sessions and signed-in devices, including WhatsApp linked devices; remove unfamiliar sessions.
- Keep evidence about the app and communication without delaying protective action.
- Report loss or misuse to local police or the relevant reporting service in your country.
Installed a suspicious app?
Do not wait for unusual phone behaviour. Some malware operates without visible symptoms.
What to keep
If you opened a file, installed an app or noticed suspicious activity, preserve basic incident details safely.
Phone number
The contact or account that sent the message.
Conversation screenshot
The message text, time and file context; avoid exposing verification codes or other secrets.
Filename
The exact attachment name and extension.
File type
APK, ZIP, PDF, document or another format.
Timeline
When the message arrived, the file was opened and any app was installed.
Granted permissions
SMS, notifications, accessibility and other sensitive access.
WhatsApp malware – FAQ
Can a file from someone I know be dangerous?
Yes. Their account may be compromised or they may unknowingly forward harmful content. Verify unexpected files through another trusted route, and assess the file itself too.
Does receiving a file mean infection?
Usually not. Risk rises when you open harmful content, run an app or grant sensitive access. Rare attacks exploiting software vulnerabilities are possible, so keep software updated.
What is an APK?
An APK is an Android app installation package. It is not inherently malicious, but an unexpected APK sent through chat requires particular caution.
Is an APK automatically malware?
No. Risk depends on origin, contents and requested permissions. Install everyday apps only from trusted official sources.
What if I downloaded the APK but did not install it?
Do not open it. Delete an unverified file and check your device with official security tools if concerned. Downloading is different from installation.
What if I already installed the app?
Stop using it, revoke sensitive permissions, uninstall it and have the device checked. Secure affected accounts from another trusted device. A clean scan or removal alone does not undo stolen information or prove safety.
How can I check whether a friend’s WhatsApp account was taken over?
Contact them outside that chat using a known trusted route. If they did not send the message, they should review linked devices and use official WhatsApp account-recovery guidance if needed.
Does Google Play Protect help?
It is an important Android protection layer that checks apps and can warn about or block harmful installations. It does not guarantee safety or replace caution.
Remember one rule
The name at the top of a chat does not establish a file’s safety.
Verify an unexpected file with its supposed sender through an independent trusted route.
If your WhatsApp account was taken over
Use the official app on a safe device. Follow WhatsApp’s recovery instructions to re-register your number with the code sent to you; enter it only in the app and share it with nobody. If an unfamiliar two-step PIN blocks recovery, follow the official waiting or recovery process. Review linked devices, sign out unfamiliar ones, enable two-step verification and warn contacts through another trusted channel.