Ghana’s Cyber Security Authority (CSA) has brought to light a sophisticated digital fraud operation in which cybercriminals are abusing WhatsApp Web to harvest sensitive financial information from unsuspecting users, including bank login credentials and one-time passwords used for mobile money and online banking verification.
The Authority disclosed that the scheme is largely directed at Windows-based computer users, with attackers circulating malicious ZIP files through WhatsApp messages that are carefully disguised as authentic documents. These files, often presented as invoices, office materials or shared work-related content, carry a highly advanced data-stealing malware known as Astaroth.
In outlining the mechanics of the attack, the CSA explained that perpetrators initiate contact by sending ZIP attachments to targeted individuals using believable cover stories designed to lower suspicion. Once the recipient downloads and extracts the file on a Windows device, the malware is silently deployed in the background, without triggering obvious warning signs.
Following installation, the Astaroth malware covertly links itself to WhatsApp Web, enabling it to access the victim’s contact list. The compromised system then automatically distributes similar infected files to all contacts, allowing the attack to propagate rapidly while remaining largely invisible to the original victim.
Beyond facilitating its own spread, the malware conducts extensive surveillance and data extraction activities. These include capturing banking usernames and passwords, intercepting one-time authentication codes, harvesting browser cookies, and recording keystrokes. Armed with this information, cybercriminals are able to unlawfully access bank accounts, drain mobile money wallets and execute fraudulent transactions without the victim’s immediate knowledge.
In response, the Cyber Security Authority has cautioned the public to remain highly vigilant when receiving files via messaging applications, stressing that even messages originating from familiar contacts may be compromised. Users have been advised to avoid opening unsolicited attachments, ensure their devices are protected with up-to-date antivirus software and operating system patches, and promptly report any unusual or suspicious activity on their financial accounts.
The CSA noted that individuals who believe their devices or accounts may have been affected can contact its technical support teams for guidance and remediation.
The latest alert comes against the backdrop of Ghana’s long-standing struggle with cybercrime, particularly scams targeting mobile money users, online banking platforms and digital payment systems. Over the past decade, the rapid expansion of mobile financial services and internet usage has outpaced public awareness and security literacy, creating fertile ground for fraudsters to exploit gaps in user behaviour and system vulnerabilities.
Despite the passage of the Cybersecurity Act, 2020 (Act 1038) and the establishment of the Cyber Security Authority, Ghana continues to grapple with phishing attacks, SIM-swap fraud, social engineering schemes and malware-driven financial theft. Authorities have repeatedly warned that cybercrime is becoming more organised, automated and cross-border in nature, requiring not only technical controls but sustained public education and cooperation.
The CSA has reiterated that cybersecurity remains a shared responsibility, urging individuals, businesses and financial institutions to adopt safer digital practices as criminals continue to evolve their tactics.
