WhatsApp malware campaign delivers VBScript and MSI backdoors
A sophisticated malware campaign targeting WhatsApp users has been observed since February 2026. The attack chain begins with malicious Visual Basic Script files sent via WhatsApp messages, which, when executed, initiate a multi-stage infection process. The malware uses renamed Windows utilities, retrieves payloads from trusted cloud services, and installs malicious MSI packages. The campaign employs social engineering, stealth techniques, and cloud-based payload hosting to establish persistence and escalate privileges on victim systems. The attackers utilize legitimate tools and trusted platforms to reduce visibility and increase the likelihood of successful execution. The final stage involves the delivery of unsigned MSI installers that enable remote access to compromised systems.
Pulse ID: 69cbf7d8bafcc9a4dafa7cb2
Pulse Link: https://otx.alienvault.com/pulse/69cbf7d8bafcc9a4dafa7cb2
Pulse Author: AlienVault
Created: 2026-03-31 16:35:36
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#BackDoor #Cloud #CyberSecurity #InfoSec #Malware #OTX #OpenThreatExchange #Rust #SocialEngineering #VBS #WhatsApp #Windows #bot #AlienVault