WhatsApp Phishing Attack Uses Fake Business Docs to Hack PCs

**Active WhatsApp phishing campaign delivers VBScript droppers disguised as invoices and business documents, which fetch second-stage payloads that establish persistence (registry keys or scheduled tasks) and enable remote access capabilities such as keylogging and file exfiltration; the report includes observed IOCs (.vbs/.zip/double-extension attachments, outbound connections to obscure domains, task/registry changes) and recommended mitigations (disable/restrict VBScript, enable ASR, monitor wscript/cscript, user training).**