Growing reports of WhatsApp-related cybercrime across multiple countries are raising concerns about the safety of the widely used messaging platform. Incidents reported in Zimbabwe, Malaysia, the Cayman Islands, Brazil, Australia, Mexico, Singapore, Taiwan, Vietnam and India include account takeovers, SIM-swapping fraud, malware distribution and users losing access to their accounts.
In Zimbabwe, the government is investigating reported WhatsApp Business account takeovers and possible security breaches involving Meta platforms. Authorities are also examining whether financial information was affected. ICT Minister Tatenda Mavetera said the ministry was working with Meta, a mobile network operator and the Zimbabwe Republic Police Cyber Crime Division to establish the facts. Investigations cover platform systems, SMS partners, advertising accounts and payment arrangements.
Mobile operator Econet Wireless and police have warned about account hijacking and scams in which criminals impersonate users to request money. They advised users to enable 2-step verification and passkeys, protect verification codes and check linked devices. No verified national figures are available on the number of Zimbabwean users affected.
In Malaysia, the communications regulator launched an investigation in September after users reported hacked, suspended or inaccessible accounts. By September 30, it had received 92 complaints and sought an explanation from Meta. Authorities also referred affected cases to the company.
Police in the Cayman Islands issued a warning on October 1 about criminals stealing the 6-digit verification codes used to register WhatsApp accounts. Once in control, scammers impersonate victims and ask their contacts for urgent financial help.
Malware campaign targets users in 11 countries
A separate campaign uncovered by cybersecurity researchers in June 2026 affected users across 11 countries and territories, including Brazil, India, Singapore, the UK, Mexico, Spain, Taiwan, Australia, Russia, Vietnam and Malaysia. Malaysia recorded the highest number of observed victims.
The campaign used malicious VBScript files disguised as documents and distributed through WhatsApp Desktop and WhatsApp Web. When opened on Windows computers, the files could install remote monitoring and management tools, potentially giving attackers unauthorised access. Malaysia’s Computer Emergency Response Team issued an advisory.
The incidents do not appear to be part of 1 confirmed, coordinated global attack. They involve different methods, including SIM swapping, stolen verification codes, impersonation and malicious attachments.
Users are advised to enable 2-step verification and passkeys, never share verification codes, avoid suspicious files and independently confirm requests for money. The cases also underline the need for stronger public awareness and closer cooperation between technology companies, telecom operators and law enforcement.
Also read: Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream LinkedIn | The Mainstream Facebook | The Mainstream Youtube | The Mainstream Twitter
About us:
The Mainstream is a premier platform delivering the latest updates and informed perspectives across the technology business and cyber landscape. Built on research-driven, thought leadership and original intellectual property, The Mainstream also curates summits & conferences that convene decision makers to explore how technology reshapes industries and leadership. With a growing presence in India and globally across the Middle East, Africa, ASEAN, the USA, the UK and Australia, The Mainstream carries a vision to bring the latest happenings and insights to 8.2 billion people and to place technology at the centre of conversation for leaders navigating the future.