Home / Technology / WhatsApp Malware Hides in Plain Sight
WhatsApp Malware Hides in Plain Sight
8 Apr
Summary
- Malware uses WhatsApp to deliver VBS scripts and MSI files.
- Attackers disguise malicious tools as legitimate Windows utilities.
- Compromised systems offer remote access and enable data theft.
A new multi-stage malware campaign has been identified, leveraging WhatsApp to distribute malicious Visual Basic Script (VBS) files and Microsoft Installer (MSI) packages. These files, disguised as harmless messages, silently install malware that grants attackers hidden control over compromised systems. The threat actors employ living-off-the-land techniques by renaming legitimate Windows utilities and embedding them within concealed folders, allowing them to blend into normal system operations.
The malware ensures its persistence by altering system settings to launch automatically after every reboot. Following the initial infection, it retrieves secondary payloads from trusted cloud services like AWS S3 and Tencent Cloud. These droppers are designed to mimic legitimate network traffic, further evading detection. The attackers also manipulate User Account Control settings and registry entries to suppress prompts and elevate privileges without user awareness.
In the final stage, unsigned MSI files such as Setup.msi and AnyDesk.msi are deployed, providing attackers with persistent remote access. This enables them to steal data, deploy additional malware, or incorporate the infected machines into botnets. Microsoft recommends vigilance regarding tampering with UAC and registry modifications, restricting script host execution, and monitoring renamed system utilities. Enhanced cloud-delivered protection and endpoint detection and response in block mode are crucial defenses.
