Cybersecurity researchers at Microsoft Defender Experts have uncovered a sophisticated new malware campaign that emerged in late February 2026.
Attackers are abusing WhatsApp messages to trick users into downloading malicious Visual Basic Script (VBS) files.
Once a victim clicks the file, a silent and highly evasive infection chain begins. The ultimate goal is to bypass system defenses, establish a permanent backdoor, and take full remote control of the compromised computer.
How The Attack Hides In Plain Sight
The attack starts with a simple social engineering trick. A WhatsApp message delivers the initial VBS script, exploiting users’ trust in familiar messaging apps.
When the victim opens the script, the malware immediately creates hidden folders on the system, specifically inside the C:\ProgramData directory.
To avoid triggering antivirus alerts, attackers drop renamed versions of trusted Windows utilities. For example, they rename the standard file transfer tool, curl.exe, to netapi.dll, and disguise bitsadmin.exe as sc.exe.
These renamed tools are then used to download the next stage of the malware. Because the tools themselves are legitimate Microsoft files, basic security software often fails to detect them. However, a closer look reveals a critical flaw.
The hidden metadata inside these files still lists their original names. Security teams can use this mismatched metadata as a powerful clue to detect the intrusion.
After securing a foothold, the renamed tools reach out to legitimate cloud hosting platforms to download secondary scripts, such as auxs.vbs.
Because services like AWS and Tencent Cloud are heavily used by businesses every day, the malicious downloads blend seamlessly with normal corporate web traffic.
This growing trend of abusing trusted cloud infrastructure makes it very challenging to block the attackers without accidentally disrupting essential business operations.
Privilege Escalation and Defending the Network
Once the secondary files are securely on the system, the attackers focus on escalating their privileges.
The malware aggressively tries to bypass Windows User Account Control (UAC). It repeatedly attempts to open a command prompt with administrative rights until it succeeds.
To ensure the victim does not notice, the malware quietly modifies the system registry under HKLM\Software\Microsoft\Win to turn off UAC security prompts.
This allows the attackers to gain deep administrative control without the user ever clicking an approval button. The malware also embeds itself in the system to ensure the infection persists even after a restart.
To protect against this sophisticated threat, organizations must adopt a multi-layered defense strategy. Security teams should restrict the execution of script files in untrusted folders and actively monitor for renamed Windows utilities.
Inspecting traffic to cloud services is also crucial to catch hidden downloads. Microsoft recommends running endpoint detection tools in block mode and turning on tamper protection to stop the malware from disabling antivirus software.
Finally, training employees to recognize suspicious WhatsApp messages remains the strongest first line of defense against these evolving cyber threats.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
