WhatsApp on Windows users targeted in new campaign, warns Microsoft

Microsoft researchers discovered a WhatsApp attachment campaign that delivers .vbs files which, when executed by a user, copy and rename legitimate Windows tools to download additional scripts and an unsigned MSI installer that sets up remote-access payloads. The attack relies on social engineering, living-off-the-land abuse of built-in tools, cloud-hosted payload delivery to blend into normal traffic, and persistence via UAC/registry modifications.