Don't open that WhatsApp message, Microsoft warns

### Executive summary A multi-stage campaign beginning in late February uses social-engineered WhatsApp messages to trick victims into running VBS attachments; the scripts create hidden folders in C:\ProgramData, drop renamed legitimate Windows utilities (e.g., curl.exe as netapi.dll, bitsadmin.exe as sc.exe) to fetch secondary VBS payloads from cloud services, attempt UAC elevation for persistence, and install unsigned MSI packages (Setup.msi, WinRAR.msi, LinkPoint.msi, AnyDesk.msi) that grant remote access for data theft, further malware deployment, or ransomware.