Fake app links on WhatsApp and Telegram put UAE users at risk, warn cyber experts

UAE residents have been advised to avoid downloading mobile applications shared through WhatsApp, Telegram and other informal channels, as such apps can provide an easy route for malware to reach personal devices.

Speaking on the sidelines of GISEC Global 2026, Pushkar Singh, country head for the Middle East and Africa at Protectt.AI, said the UAE has one of the highest volumes of app downloads globally, making it an attractive target for attackers distributing malicious software disguised as legitimate applications.

Download Apps Only From Official Stores

Singh advised Android users to download applications only from the Google Play Store and iPhone users from the Apple App Store.

He warned that applications circulated through messaging platforms, the dark web and other unofficial channels may have been modified or compromised without users knowing.

Technology can help organisations identify applications that have been downloaded from illegitimate sources or tampered with, Singh said. Security controls can also prevent such applications from operating even after they have been installed on corporate devices.

Some malicious applications are “re-engineered” by injecting harmful code into legitimate software. Singh said technologies such as code obfuscation and runtime protection can help defend against these threats.

AI Is Making Social Engineering Scams More Sophisticated

Singh also highlighted the growing use of artificial intelligence in social engineering attacks.

Voice and video duplication technologies are making it easier for criminals to impersonate individuals. Fraudsters can potentially use AI-generated voices or video likenesses to make transactions appear legitimate during calls.

He also cautioned users against using VPNs and proxy services without understanding how and where their internet traffic is being routed, as intercepted traffic can create additional security risks.

Fintech Growth Increases Cybersecurity Risks

The rapid growth of fintech across the UAE and wider GCC is also increasing the importance of securing digital transactions.

Singh said companies are increasingly viewing runtime application self-protection and AI security as essential investments rather than optional tools because cyber incidents can result in both financial losses and reputational damage.

He advised businesses to choose cybersecurity solutions based on their specific requirements rather than focusing solely on cost. Protection should also extend beyond core applications to mobile devices and AI agents, where enterprises may have less direct control.

AI Threats Are Moving Faster Than Traditional Defences

The wider discussions at GISEC Global 2026 also focused on the growing sophistication of AI-powered cyber threats.

CPX chief executive Hadi Anwar said threats involving deepfakes, identity attacks and AI-powered social engineering are increasing, alongside risks linked to ungoverned AI use, data leakage and model manipulation.

According to Anwar, generative AI has made cybersecurity a broader business and governance concern rather than a purely technical issue. He stressed the need for stronger oversight across the AI lifecycle and greater protection of digital supply chains that depend on third-party AI models.

Supply-Chain and Phishing Attacks Remain a Concern

Ashraf Koheil, Vice President of Sales for Meta and ANZ at Group-IB, said GCC countries were among the world's top 10 targets for supply-chain attacks in 2025.

He also said phishing attacks against the financial services sector in the region accounted for 28.5 per cent of such attacks across the Middle East and Africa.

Group-IB's “Prediction-First” approach combines continuous monitoring of threat actors, compromised credentials and malicious infrastructure with AI-powered analysis to identify potential risks before they develop into major incidents.

Koheil noted that cyber threats increasingly extend beyond a company's own systems to suppliers, fintech partners and payment providers, making broader security monitoring and local expertise increasingly important.