WhatsApp Under Siege: Microsoft Uncovers Global VBS Malware Campaign

Microsoft Defender researchers detail a widespread 2026 WhatsApp-based malware campaign that delivers malicious VBS scripts which drop renamed Windows utilities and retrieve secondary payloads from trusted cloud platforms (AWS S3, Tencent Cloud, Backblaze) to evade detection; the malware repeatedly attempts UAC elevation, installs MSI packages for persistence and enables remote access, while defenders are advised to block/limit script hosts, monitor cloud downloads and registry tampering, and inspect PE OriginalFileName metadata for anomalies.