New Windows Malware Spreads Via WhatsApp, Grants Remote Access

Key Takeaways

• A novel malware campaign is actively exploiting WhatsApp to deliver remote access capabilities to Windows systems.
• The attack propagates through malicious VBScript files disguised as financial documents, sent via compromised WhatsApp accounts.
• Victims have been identified in over a dozen countries, with Malaysia experiencing approximately 80% of reported infections.
• The malware installs legitimate remote management software, making detection more challenging for standard security tools.
• Indicators suggest a Chinese-speaking threat actor is behind the campaign.

A sophisticated and ongoing malware campaign is leveraging WhatsApp to compromise Windows users across at least 12 countries, granting attackers unauthorized remote access to their systems. Cyber intelligence firm Resecurity recently published an in-depth report detailing the intricate mechanisms and global reach of this operation.

The attack employs social engineering tactics, utilizing malicious script files that mimic common financial documents. These files trick unsuspecting users into executing harmful code on their machines, initiating a covert infection chain.

Upon execution, the disguised script silently triggers a sequence of actions culminating in the attackers establishing full remote control over the victim’s computer.

First detected in June 2026, this campaign remains active. Resecurity’s analysis identified victims in diverse regions, including Malaysia, Brazil, India, Mexico, Singapore, the United Kingdom, Spain, Taiwan, Australia, Russia, and Vietnam. Notably, Malaysia has borne the brunt of the attacks, accounting for an estimated 80% of all recorded infections, as highlighted in a comprehensive analysis by Securelist.

According to the Securelist report shared with Cyber Security News (CSN), the threat actors gained control of legitimate WhatsApp accounts. They then exploited these compromised accounts to discreetly send malicious attachments to all contacts within the respective address books.

This method significantly increases the likelihood of successful compromise, as recipients are far more prone to open attachments from trusted, known contacts without suspicion.

Infection Chain Details

The malicious attachments are VBScript files, a type of script natively executable by Windows via the built-in Windows Script Host. These files are cleverly named to appear innocuous, such as “Financial Reports.vbs,” “Debt Statement.vbs,” and “Account Statement.vbs.” The campaign’s global targeting is further evidenced by the availability of these malicious files in multiple languages, including Portuguese, French, German, and Malay.

A distinguishing characteristic of this attack is its final payload: the installation of legitimate remote management software rather than conventional malware like viruses or data stealers. This approach allows attackers to operate with the same level of access as an IT support team, making detection significantly more challenging for conventional security solutions.

The infection process commences when a user opens the VBScript attachment, whether through the WhatsApp Desktop application or WhatsApp Web in a browser. The script executes silently via Windows Script Host, immediately preparing the system for subsequent stages of compromise. It establishes a hidden folder within the Public Documents directory, using randomized names like “MSUpdate_random” to evade detection.

Subsequently, the initial script downloads two additional script files from servers controlled by the attackers. The first of these secondary scripts attempts to modify User Account Control (UAC) settings in Windows, typically responsible for alerting users before significant system changes. By disabling or lowering UAC prompts, the path is cleared for the second script to install software without user intervention or on-screen notifications.

The second downloaded script retrieves a ZIP archive containing a fully pre-configured installation package for a remote management agent. Once extracted and executed, this package silently installs itself using Windows Installer. Upon successful installation, the agent establishes a persistent connection to the attacker’s command-and-control servers, granting them covert and ongoing remote access to the victim’s machine.

Signs Pointing to a Chinese-Speaking Operator

Security researchers have identified several clues within the script files that suggest the involvement of a Chinese-speaking developer. Multiple variants of the VBScript contained comments and annotations written in simplified Chinese characters. These comments included references to Windows Update modules and system integrity checks, appearing consistently across various script versions.

Furthermore, an analysis of the attacker’s infrastructure revealed overlaps with previously documented malware families. One of the IP addresses used by the attacker-controlled servers had been associated with the ValleyRAT and Gh0st RAT malware in prior campaigns. While this correlation does not definitively confirm attribution, researchers assess with low confidence that the campaign is likely orchestrated by a Chinese-speaking operator.

What You Should Do

• Exercise Extreme Caution with Attachments: Never open attachments received via WhatsApp, even from known contacts, unless you have independently verified the file’s legitimacy through another communication channel (e.g., a phone call or email).
• Beware of Executable File Types: Be particularly suspicious of file types such as VBS, VBE, EXE, BAT, CMD, JS, and PS1. These should never be opened without explicit, independent confirmation.
• Maintain User Account Control (UAC): Ensure your Windows User Account Control (UAC) settings are kept at their default or higher security levels. This provides crucial alerts before unauthorized system changes.
• Keep Endpoint Protection Updated: Regularly update and run comprehensive endpoint detection and response (EDR) or antivirus software. Ensure real-time protection is enabled.
• Educate Yourself and Others: Stay informed about common social engineering tactics and phishing attempts. Share this knowledge with colleagues, friends, and family who use WhatsApp.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.