A customer sent you an APK file. Is it a scam?

Most of the time, the customer is not sending them. Their WhatsApp is.

The scam works in a chain. Someone receives a file that looks like a payment receipt, a wedding invitation, a parcel tracking notice or a legal letter. They open it. The file is really an Android app or a Windows script that gives the scammer control of the phone or computer, including WhatsApp. From that moment, their WhatsApp sends the same file to everyone in their contacts: friends, family, colleagues, and the businesses they have chatted with. That includes you.

Malaysian police have warned about this since 2023. In June 2024 the director of the Bukit Aman Commercial Crime Investigation Department said that once a victim installs such an app, "the criminal will gain full access to the victim's phone without their knowledge", and asked the public to "avoid downloading any application files (.apk) received through messages, emails, or other similar channels."

The files have changed since. In June 2026 MyCERT warned of files sent through WhatsApp that are "disguised as legitimate legal, debt, or financial documents" but are really Visual Basic Script (.vbs) files aimed at computers running WhatsApp Web and Desktop, and that "a standard antivirus scan is unlikely to detect or remove" what they install. In October 2026, reports described ZIP and RAR files "being sent from existing contacts, including friends, colleagues, and business contacts", whose WhatsApp "may have been compromised without their knowledge".

For a business, that means the file arrives in your shared inbox, from a real customer, in a chat that looks normal. Anyone on your team can tap it, especially when it is named like something you expect from a customer, such as a receipt.

Real customers do sometimes send zip files, for example a set of documents for a quotation. So the goal is not to block every file, but to make sure nobody opens one without a reason. Agree on four steps with your team:

1. Don't open or download it on a work device. Your work phone and the computer running WhatsApp Web hold every customer chat. That is exactly what the scammer wants.
2. Ask in the chat what the file is. "Hi, we received a file from you. Did you mean to send it?" A real customer will explain. A hacked number usually doesn't answer, or the customer replies that they never sent anything.
3. If it's genuine, ask for a safer format. A PDF or photos instead of a zip is a fair request. If you must open the original, do it on a device you can afford to wipe.
4. If the number looks hacked, tell the customer. They often don't know. Suggest they turn off the internet on every device where their WhatsApp is logged in, and turn on two-step verification.

Write these four steps where every agent sees them, and make sure the newest staff member knows them. The person most likely to tap the file is the one who doesn't know it can be dangerous.

Mampu AI watches both directions of your WhatsApp chats.

When a customer sends a risky file or link, the chat marks it in red: Risky file type. Don't open it unless you expected this file. under the file, and This link downloads a risky file type. Don't open it unless you expected it. under a link that points straight at one. The agent assigned to the chat and every admin get a Risky file or link notice in My Inbox naming the file or link; when nobody is assigned, the admins get it. It only warns: nothing is blocked, no label is added and your AI agent keeps answering, because real customers send these files too. Each person can also turn on email or push for this notice in their notification preferences.

When your own number sends zip or program files to 3 or more chats within 10 minutes, your inbox shows a red alert and your admins get an email at once, then again every 5 minutes while files keep going out. Your AI agent on that inbox stays quiet so a person handles the questions, and every customer who got a file is labelled suspicious-file-received, so you can warn them all with one WhatsApp blasting.