WhatsApp Critical Flaw Lets Attackers Install MSI Backdoors

Key Takeaways

• A new, sophisticated malware campaign is actively exploiting WhatsApp to target Windows users.
• The attack chain uses VBS scripts, living-off-the-land techniques, and cloud services to deliver malicious MSI backdoors.
• Malware disguises itself as legitimate system files and downloads, bypassing traditional security measures.
• The campaign aims to establish persistent remote access for data theft and further malicious activities.
• Microsoft identified this campaign in late February 2026, and a fix is available through robust security practices and user awareness.

A sophisticated new malware campaign is actively leveraging WhatsApp to deploy malicious files, primarily targeting Windows operating systems. This multi-stage attack capitalizes on the inherent trust users place in popular messaging applications, initiating with Visual Basic Script (VBS) files before escalating to cloud-based payload delivery and culminating in the installation of persistent MSI backdoors.

Threat actors are distributing these harmful VBS files via WhatsApp messages, exploiting the common tendency for users to open attachments from platforms they perceive as secure. Once executed, these scripts silently initiate an infection process in the background, providing no immediate visual indicators to the user.

Stealth and Evasion: Living Off The Land

What distinguishes this campaign is its cunning use of “living-off-the-land” techniques, where attackers utilize legitimate tools already present in the Windows environment rather than introducing easily detectable foreign programs. This approach allows the malware to blend seamlessly into normal system operations.

For instance, legitimate Windows utilities like curl.exe and bitsadmin.exe are renamed to resemble standard system files and then placed in hidden directories within C:ProgramData. Subsequently, secondary payloads are retrieved from trusted cloud platforms such as Amazon Web Services (AWS) S3, Tencent Cloud, and Backblaze B2. This method makes the malicious downloads appear as routine system traffic, further aiding evasion.

The Microsoft Defender Security Research Team first detected this campaign in late February 2026. Researchers observed that the operation skillfully combines social engineering with stealthy infection methods. It progresses through several stages to install malicious MSI packages, establish persistence across system reboots, and create remote access channels, granting attackers full, ongoing control over compromised machines.

The campaign ultimately deploys several unsigned MSI installer packages, including files named Setup.msi, WinRAR.msi, LinkPoint.msi, and AnyDesk.msi. The absence of a valid code-signing certificate on these files serves as a critical red flag, as legitimate enterprise software typically carries a trusted publisher signature. Upon execution, these installers establish persistent remote access, enabling attackers to exfiltrate data, deploy additional malware, or integrate the compromised system into larger attack operations.

How the Attack Unfolds: From VBS to Full System Compromise

The attack chain commences when a user opens the malicious VBS file received via WhatsApp. The script immediately creates hidden directories within C:ProgramData and drops renamed versions of legitimate Windows utilities. For example, curl.exe is disguised as netapi.dll, and bitsadmin.exe is renamed sc.exe. Despite these name changes, both files retain their original PE metadata, specifically the OriginalFileName field. This discrepancy between the visible filename and the embedded metadata is a detectable anomaly that security solutions can leverage to identify the threat.

These disguised tools then proceed to download additional VBS payloads from attacker-controlled infrastructure hosted on cloud services. Examples of these secondary scripts include auxs.vbs and WinUpdate_KB5034231.vbs. Hosting these files on widely used platforms like AWS S3 and Backblaze B2 is a strategic choice, as corporate firewalls rarely block traffic to these legitimate services. The filenames themselves are also crafted to mimic authentic Windows update packages, further reducing suspicion and the likelihood of detection.

Once the secondary scripts are on the system, the malware begins manipulating User Account Control (UAC) settings. It repeatedly attempts to execute cmd.exe with elevated privileges, modifying registry entries under HKLMSoftwareMicrosoftWin until administrative rights are acquired. With administrative control secured, the malware suppresses security prompts, ensuring that the final MSI installers run without triggering any alerts or interruptions that might warn the user or IT administrators.

What You Should Do

• Block Script Hosts: Configure your systems to prevent script hosts like wscript and cscript from executing in untrusted directories.
• Monitor Renamed Utilities: Implement monitoring for renamed Windows utilities running with unusual command-line arguments. The mismatch between file name and original PE metadata is a key indicator.
• Inspect Cloud Traffic: Enhance inspection and filtering of traffic to common cloud platforms such as AWS S3, Tencent Cloud, and Backblaze B2, as these are often exploited for payload delivery.
• Track Registry Changes: Monitor registry modifications under HKLMSoftwareMicrosoftWin in real time, particularly repeated attempts to tamper with UAC settings, which indicate an active compromise.
• Enable EDR in Block Mode: Utilize Endpoint Detection and Response (EDR) solutions in block mode to automatically stop malicious artifacts, even if primary antivirus solutions fail to detect them.
• Activate Tamper Protection: Ensure tamper protection is enabled on security services to prevent attackers from disabling them post-compromise.
• Configure Attack Surface Reduction Rules: Implement Attack Surface Reduction (ASR) rules to block VBScript from launching downloaded executables, adding a critical layer of defense.
• User Awareness Training: Educate end-users to exercise caution and question unexpected attachments received via WhatsApp or other messaging platforms, even if they appear to come from known contacts. This remains a fundamental defense against social engineering attacks.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.