WhatsApp Attack Chain Delivers VBS, Cloud Payloads, MSI Backdoor

Microsoft observed a late-February 2026 campaign delivering VBS attachments via WhatsApp that drop secondary VBS payloads from legitimate cloud services and use renamed living-off-the-land binaries to fetch and install unsigned MSI backdoors; the actors attempt UAC bypass and registry tampering to gain persistent elevated access, and defenders are advised to monitor PE metadata, command-line usage, UAC-related registry changes, and suspicious downloads from cloud providers.