Execution starts with an attachment
Microsoft reported on 31 March that a malware campaign used WhatsApp messages to deliver malicious Visual Basic Script files. Once executed, the scripts began a staged chain using legitimate Windows utilities and externally hosted payloads. Researchers said the activity had begun in late February; the report date is separate from that observed start.
Trusted hosting did not validate the file
The chain used established cloud services and malicious installer packages to help maintain access. Those services and utilities also have legitimate uses, which made the surrounding process behaviour important to the investigation. The report concerns files a recipient executed, not a claim that receiving any WhatsApp message compromised Windows. A recognisable messaging app or download host did not establish the safety of the attachment.
Sources & further reading
WhatsApp malware campaign delivers VBScript and MSI backdoorsPublished by Capvise Media. Editorial standards · Corrections
