WhatsApp Weaponized: VBS Malware Exploits UAC to Hijack Windows

Microsoft has issued a warning about a new malware campaign that leverages WhatsApp messages to distribute malicious Visual Basic Script (VBS) files, initiating a multi-stage infection chain designed to establish persistence and enable remote access on Windows systems.

How the Attack Works

• Initial delivery: Malicious VBS files are sent via WhatsApp messages.
• Hidden foothold: Scripts create concealed folders in C:\ProgramData and drop renamed legitimate Windows utilities (e.g., curl.exe disguised as netapi.dll, bitsadmin.exe disguised as sc.exe).
• Cloud-hosted payloads: Secondary VBS files are retrieved from AWS S3, Tencent Cloud, and Backblaze B2, blending malicious traffic with trusted services.
• Persistence & privilege escalation: Attackers tamper with User Account Control (UAC) settings, repeatedly launching cmd.exe with elevated privileges until successful. Registry entries under HKLM\Software\Microsoft\Win are modified to embed persistence.

Why It’s Dangerous

• Living-off-the-land techniques: By abusing renamed Windows utilities, attackers blend into normal system activity.
• Cloud camouflage: Hosting payloads on trusted platforms makes detection harder.
• UAC bypass: Privilege escalation allows unsigned MSI installers to run, including legitimate tools like AnyDesk, which attackers use for persistent remote access.

Impact

Once established, the malware enables attackers to:

• Exfiltrate sensitive data.
• Deploy additional malware.
• Maintain long-term control of compromised systems.

Defensive Guidance

• User awareness: Train employees to avoid opening unexpected files received via WhatsApp or other messaging platforms.
• Endpoint monitoring: Watch for renamed Windows utilities and suspicious child processes.
• Registry auditing: Check for unauthorized modifications under UAC-related keys.
• Network controls: Monitor traffic to cloud services for unusual download activity.
• Application control: Restrict installation of unsigned MSI packages.

Final Thought

This campaign demonstrates how attackers are combining social engineering, stealth techniques, and cloud-based payload hosting to bypass defenses. With WhatsApp now being weaponized as a delivery vector, organizations must strengthen endpoint visibility and privilege controls to stay ahead of evolving malware tactics.