Malware campaign spreads via compromised WhatsApp accounts

Cybersecurity researchers have uncovered an ongoing, global malware campaign that uses compromised WhatsApp accounts to distribute malicious files disguised as legitimate business documents, ultimately installing remote access software on victims' computers. The campaign, detailed in a technical analysis by Kaspersky, targets users of WhatsApp Desktop and WhatsApp Web across at least eleven countries, with Malaysia reporting the highest number of victims.

The attack begins when a user receives a direct message, often containing only an attachment, from a known contact whose account has been compromised. The files are Visual Basic Script (VBS) files named to appear as financial or business documents, such as "Financial Reports.vbs" or "Account Statement.vbs." To increase its global reach, the campaign uses file names localized in multiple languages, including Portuguese, French, German, and Malay.

If a recipient opens the file, it triggers a multi-stage infection. The initial VBScript, launched via Windows Script Host (WScript.exe), downloads two secondary payloads from a remote server. One script attempts to disable Windows User Account Control (UAC) protections by modifying a...