Microsoft: Hackers Are Using WhatsApp to Deliver Malware to Windows PCs

A recent campaign delivers malicious VBS attachments over WhatsApp to Windows desktops and web clients; clicking the attachment executes scripts that create hidden folders in C:\ProgramData, rename binaries to mimic system files, fetch payloads from trusted cloud services (AWS S3, Tencent Cloud, Backblaze B2), attempt UAC bypasses and registry modifications to achieve persistence, and ultimately install unsigned installers to enable backdoors and remote control. Microsoft researchers observed this wave beginning in late February and recommend improving endpoint controls, monitoring registry/UAC changes, enabling tamper protection, applying zero-trust principles, and blocking known C2 infrastructure.