No Link, No Call: Just One Image Led to Rs 2 Lakh Theft on WhatsApp

A 28-year-old man in Jabalpur lost Rs 2 lakh after downloading an image sent via WhatsApp that contained hidden malware. The code used steganography to embed a data packet in a standard-looking file. Once saved, the file installed itself and granted full access to the victim's banking apps.

Steganography in cybercrime embeds malicious code inside images or audio files. Unlike links or attachments, images bypass basic filters and auto-download settings. In this case, the malware intercepted one-time passwords (OTPs), decrypted banking credentials and transferred funds in the background.

Security analysts warn that most antivirus software cannot detect these attacks because the payload hides within pixels rather than as a standalone file. Users receive no prompts or warnings. The file appears as a harmless photo until opened.

Experts identify three key risks:

1. Zero interaction requirement: malware runs on download without clicks.

2. Filter bypass: embedded code escapes standard security scans.

3. Silent operation: banking data is stolen without user notice.

By the time the Jabalpur victim noticed activity, his account balance had dropped by Rs 2 lakh. Local police have opened an investigation. Representatives from the bank are tracing the transfer path but caution that recovery is unlikely without rapid action.

Cybersecurity advisers recommend the following steps to block image-based malware:

* Disable media auto-download: open WhatsApp settings, navigate to Storage and Data, and turn off all media auto-download options.

* Reject files from unknown contacts: delete unsolicited images without opening.

* Restrict group invites: set group privacy to contacts only.

* Verify source before sharing sensitive data: confirm identity via separate channel.