Malware Attack Via WhatsApp Targets Windows Systems.

A new and active malware campaign is spreading through WhatsApp, targeting Windows users across multiple countries and enabling attackers to gain persistent remote access to compromised systems.

Security researchers have identified a sophisticated attack chain that abuses trusted WhatsApp contacts, malicious VBScript attachments, and legitimate remote management software to silently take control of victims' computers.

The campaign was first observed in June 2026 and remains active. Confirmed victims have been identified in Malaysia, Brazil, India, Mexico, Singapore, the United Kingdom, Spain, Taiwan, Australia, Russia, and Vietnam.

WhatsApp Accounts Used to Spread Malware

According to researchers, threat actors compromised legitimate WhatsApp accounts and used them to distribute malicious attachments to contacts. Because the messages appeared to come from trusted individuals, recipients were more likely to open the files without suspicion.

Image Caption: Overview of the WhatsApp-based VBScript infection chain.Alt Text: Diagram showing the multi-stage WhatsApp malware infection process targeting Windows systems.

The malicious attachments were primarily VBScript (.VBS) files disguised as financial documents. Common filenames included:

• Financial Reports.vbs

• Debt Statement.vbs

• Account Statement.vbs

• Outstanding Payment List.vbs

Researchers also discovered versions written in Portuguese, French, German, and Malay, indicating that the campaign was designed to target users across multiple regions.

How the Malware Infection Works

The attack begins when a victim opens the malicious VBScript attachment received through WhatsApp Desktop or WhatsApp Web.

Image Caption: Malicious WhatsApp messages delivering VBScript payloads.Alt Text: WhatsApp conversations containing fake financial document attachments used to spread malware.

Once executed, the script launches through Windows Script Host and creates hidden directories within the Public Documents folder using randomized names designed to avoid detection.

The malware then downloads two additional scripts from attacker-controlled infrastructure.

Stage 1: Security Bypass

The first downloaded script attempts to disable Windows User Account Control (UAC), a security mechanism that normally warns users before major system changes occur.

By reducing UAC protections, attackers can perform additional actions without displaying warning prompts.

Stage 2: Remote Management Installation

The second script downloads a ZIP archive containing a fully configured installation package for a remote management agent.

After extraction, the software is silently installed using Microsoft's Windows Installer utility (msiexec.exe).

Once installation is complete, the remote management agent connects back to attacker-controlled servers, giving attackers persistent access to the victim's machine.

Attackers Abuse Legitimate Software

Unlike traditional malware campaigns that deploy ransomware or credential stealers, this operation relies on legitimate enterprise remote administration software.

Because the software itself is genuine, many security solutions may classify it as trusted, allowing attackers to blend into normal system activity.

This "living-off-the-land" approach significantly reduces the likelihood of detection while providing extensive control over infected devices.

Image Caption: Extracted Stage 3 installation package used to deploy the remote management agent.Alt Text: Files extracted from the malware ZIP package containing the remote management software.

Evidence Suggests a Chinese-Speaking Operator

Researchers discovered several indicators suggesting involvement by a Chinese-speaking threat actor.

Multiple VBScript samples contained comments written in Simplified Chinese, including references to:

• Windows Update functionality

• System integrity checks

• Administrative execution routines

Additionally, one of the command-and-control servers used in the campaign has previously been associated with malware families such as ValleyRAT and Gh0st RAT.

While researchers caution that attribution remains uncertain, they assess with low confidence that the operation was likely conducted by a Chinese-speaking actor.

Persistent Access Through Endpoint Management Tools

The final stage of the infection installs a remote management agent that allows attackers to:

• Remotely access files

• Execute commands

• Deploy additional payloads

• Monitor system activity

• Maintain long-term persistence

Image Caption: Remote management agent installation executed through msiexec.exe.Alt Text: Windows Installer process deploying the attacker-controlled endpoint management agent.

Once connected, attackers effectively gain the same level of access that an organization's IT department would have over managed devices.

Countries Impacted

Researchers identified victims in:

• Malaysia

• Brazil

• India

• Mexico

• Singapore

• United Kingdom

• Spain

• Taiwan

• Australia

• Russia

• Vietnam

Malaysia accounted for approximately 80% of all observed infections, making it the most heavily targeted country in the campaign.

Security Recommendations

Users should take the following precautions:

Do Not Open Suspicious Attachments

Avoid opening attachments received through WhatsApp, even if they originate from known contacts. Verify the legitimacy of files through an alternate communication channel.

Be Wary of Script Files

Never open the following file types unless independently verified:

• VBS

• VBE

• EXE

• BAT

• CMD

• JS

• PS1

Maintain Windows Security Settings

Keep User Account Control (UAC) enabled and avoid modifying security settings unless necessary.

Use Updated Endpoint Protection

Modern endpoint security solutions can help detect suspicious script execution and unauthorized remote management activity.

Indicators of Compromise (IoCs)

Attacker-Controlled IP Addresses

Malicious Domains

Payload Hosting Infrastructure

Note: All domains and IP addresses remain intentionally defanged to prevent accidental access or execution.

This campaign demonstrates how threat actors continue to abuse trusted communication platforms and legitimate administrative tools to bypass traditional security controls. By leveraging compromised WhatsApp accounts, multi-language social engineering lures, and genuine remote management software, attackers are achieving persistent access while minimizing detection.

Organizations and individuals should remain cautious when receiving unexpected attachments through messaging platforms and should verify suspicious files before opening them.