Railway threat report

Indian Railways issued a cyber-security advisory following a script-based malware incident in Central Railway on August 11, 2026. The attack involved distribution of a malicious VBScript file (E-statement.vbs) through WhatsApp Web targeting railway staff. CERT-In confirmed a broader campaign distributing malicious VBScript files through WhatsApp, including via compromised accounts. Railways directed all units to strengthen endpoint protection, enable multi-factor authentication, and train employees to avoid suspicious file extensions and attachments.

• Railways Issues Cyber-security Alert To Its Staff After Malware (opens in a new tab)