As internet usage becomes more widespread, online scams are evolving at an alarming pace. One of the latest and most dangerous forms of cyberattack now making headlines doesn’t require victims to click on a link, provide their OTPs, or enter personal details. Instead, it uses a subtle and far more deceptive method—infecting devices through ordinary-looking images sent via WhatsApp.
This new scam, recently reported from Jabalpur in Madhya Pradesh, has raised serious concerns about user safety. In the reported incident, a man received an image on WhatsApp from an unknown number, accompanied by a request to help identify someone in the photo. Initially ignoring the message, he was later persuaded to open it after receiving multiple phone calls from the same number. Upon viewing the image, his device was silently compromised. Unbeknownst to him, the malware embedded within the image gained access to his sensitive banking information, ultimately resulting in a financial loss of nearly Rs. 2 lakh.
What makes this scam particularly alarming is the technique used—steganography. Unlike typical phishing or malware attacks that depend on a user clicking a link or downloading an attachment, this method conceals harmful code within the image itself. Specifically, the attackers use a method known as Least Significant Bit (LSB) steganography, which hides malware in the most minuscule parts of the image data. When the image is opened, the malware activates in the background without giving any warning or indication of infection. It can then proceed to access personal information, banking apps, passwords, OTPs, and can even seize control of the entire phone.
The implications of this type of attack are deeply concerning because they bypass conventional warning signs. Most users are conditioned to be cautious about suspicious links or sharing personal information online. But a simple image—seemingly harmless—can now be a powerful tool in the hands of cybercriminals. This method also highlights the growing sophistication of attackers and their ability to adapt to security measures that once kept such threats at bay.
In light of these developments, users are being urged to be cautious about any media they receive from unknown sources on WhatsApp. Disabling auto-download for media files, keeping operating systems and antivirus software up to date, and verifying unknown numbers through trusted apps can offer some level of protection. Moreover, if users feel that their devices may have been compromised, they should immediately report the incident to the authorities through the national cybercrime portal at cybercrime.gov.in and inform their banks to prevent further losses.
This incident is a stark reminder of how rapidly cyber threats are advancing. It also highlights the urgent need for greater digital awareness and personal responsibility in handling messages and media on widely used platforms like WhatsApp. As cybercriminals explore new ways to exploit unsuspecting users, staying informed and cautious remains one of the strongest defenses against such hidden threats.
