CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

WhatsApp-delivered VBS malware abuses UAC bypass for persistent Windows compromise via cloud-hosted MSI payloads

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A malware campaign observed since late February 2026 delivers malicious Visual Basic Script (VBS) files to Windows users via WhatsApp, executing multi-stage attacks to establish persistence and enable remote access. The attack chain uses renamed legitimate Windows utilities (e.g., curl.exe → netapi.dll, bitsadmin.exe → sc.exe) to evade detection, retrieves payloads from trusted cloud services (AWS S3, Tencent Cloud, Backblaze B2), and installs unsigned MSI packages. The malware weakens User Account Control (UAC) defenses by repeatedly attempting elevated cmd.exe execution, modifying registry keys under HKLM\Software\Microsoft\Win, and embedding persistence to survive reboots. This enables privilege escalation without user interaction and deployment of remote access tools like AnyDesk, facilitating data theft and secondary malware delivery.

Timeline

  1. 01.04.2026 14:49 1 articles · 3h ago

    WhatsApp-delivered VBS malware establishes persistent Windows compromise via UAC bypass and cloud-hosted MSI payloads

    Since late February 2026, a campaign has delivered malicious VBS files via WhatsApp to Windows users. Execution creates hidden directories in C:\ProgramData and drops renamed Windows utilities (e.g., netapi.dll for curl.exe) to blend into normal activity. Payloads are retrieved from AWS S3, Tencent Cloud, and Backblaze B2 using these renamed binaries, followed by installation of unsigned MSI packages. The malware weakens UAC defenses by repeatedly attempting elevated cmd.exe execution, modifying registry keys (HKLM\Software\Microsoft\Win), and embedding persistence to survive reboots. This enables privilege escalation without user interaction and deployment of remote access tools like AnyDesk.

    Show sources
    Open in new tab

Information Snippets