The Cyber Security Authority (CSA) has uncovered a dangerous cyber-attack scheme in which criminals are exploiting WhatsApp Web to steal banking credentials and one-time passwords (OTPs), including mobile money verification codes, from unsuspecting users in Ghana.
According to the CSA, the attack primarily targets Windows computer users through malicious ZIP files sent via WhatsApp messages and disguised as legitimate documents. The malware involved in the operation has been identified as Astaroth, a sophisticated information-stealing virus.
Explaining how the attack works, the CSA said threat actors initiate the process by sending victims ZIP files through WhatsApp, often under convincing pretexts such as work documents, invoices, or shared files. Once a user downloads and extracts the file on a Windows device, the Astaroth malware is installed without raising suspicion.
After installation, the malware secretly connects to WhatsApp Web, retrieves the victim’s contact list, and automatically sends similar malicious messages to all contacts, allowing the virus to spread rapidly without the victim’s knowledge.
In the background, the malware carries out extensive data-harvesting operations. These include stealing banking login details, one-time passwords (OTPs), browser cookies, and recording keystrokes. The stolen information can then be used by criminals to gain unauthorized access to bank accounts, compromise mobile money wallets, and carry out fraudulent transactions.
The Cyber Security Authority has urged the public to exercise extreme caution when opening files received through messaging platforms, even when they appear to come from known contacts.
Users are advised not to download or open suspicious attachments, to keep their devices updated with the latest security patches and antivirus software, and to immediately report any unusual activity on their accounts.
Anyone affected by the malware can reach out to engineers at the CSA for assistance via the contacts below:
- Email: report@csa.gov.gh
- Call:292
- SMS: 292
- WhatsApp: 0501603111
- Mobile App: CSA GHANA
