Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Home windows by way of UAC Bypass

Ravie LakshmananApr 01, 2026Social Engineering / Malware

Microsoft is asking consideration to a brand new marketing campaign that has leveraged WhatsApp messages to distribute malicious Visible Primary Script (VBS) recordsdata.

The exercise, starting in late February 2026, leverages these scripts to provoke a multi-stage an infection chain for establishing persistence and enabling distant entry. It is presently not recognized what lures the menace actors use to trick customers into executing the scripts.

“The marketing campaign depends on a mix of social engineering and living-off-the-land methods,” the Microsoft Defender Safety Analysis Workforce mentioned. “It makes use of renamed Home windows utilities to mix into regular system exercise, retrieves payloads from trusted cloud providers resembling AWS, Tencent Cloud, and Backblaze B2, and installs malicious Microsoft Installer (MSI) packages to keep up management of the system.”

The usage of reliable instruments and trusted platforms is a lethal mixture, because it permits menace actors to mix in regular community exercise and enhance the chance of success of their assaults.

The exercise begins with the attackers distributing malicious VBS recordsdata by way of WhatsApp messages that, when executed, create hidden folders in “C:ProgramData” and drop renamed variations of reliable Home windows utilities like “curl.exe” (renamed as “netapi.dll”) and “bitsadmin.exe” (renamed as “sc.exe”).

Upon gaining an preliminary foothold, the attackers goal to set up persistence and escalate privileges, finally putting in malicious MSI packages on sufferer programs. That is achieved by downloading auxiliary VBS recordsdata hosted on AWS S3, Tencent Cloud, and Backblaze B2 utilizing the renamed binaries.

“As soon as the secondary payloads are in place, the malware begins tampering with Consumer Account Management (UAC) settings to weaken system defenses,” Redmond mentioned. “It constantly makes an attempt to launch cmd.exe with elevated privileges, retrying till UAC elevation succeeds or the method is forcibly terminated, modifying registry entries underneath HKLMSoftwareMicrosoftWin, and embedding persistence mechanisms to make sure the an infection survives system reboots.”

These actions permit the menace actors to achieve elevated privileges with out consumer interplay by way of a mix of Registry manipulation with UAC bypass methods, and finally deploy unsigned MSI installers. This consists of reliable instruments like AnyDesk that present attackers with persistent distant entry, enabling the attackers to exfiltrate information or deploy extra malware.

“This marketing campaign demonstrates a complicated an infection chain combining social engineering (WhatsApp supply), stealth methods (renamed reliable instruments, hidden attributes), and cloud-based payload internet hosting,” Microsoft mentioned.