{"id":24147,"date":"2026-04-23T10:00:02","date_gmt":"2026-04-23T03:00:02","guid":{"rendered":"https:\/\/fpt-is.com\/en\/?post_type=goc_nhin_so&p=24147"},"modified":"2026-06-23T14:55:08","modified_gmt":"2026-06-23T07:55:08","slug":"whatsapp-malware-campaign-delivering-vbs-payloads-and-msi-backdoors","status":"publish","type":"goc_nhin_so","link":"https:\/\/fpt-is.com\/en\/insights\/whatsapp-malware-campaign-delivering-vbs-payloads-and-msi-backdoors\/","title":{"rendered":"WhatsApp malware campaign delivering VBS payloads and MSI backdoors"},"content":{"rendered":"

Executive Summary<\/span><\/h2>\n

In late February 2026, Microsoft Defender Experts detected a sophisticated attack campaign leveraging WhatsApp to distribute malicious Visual Basic Script (VBS) files to Windows users. Once a victim executes the file, a multi-stage infection chain is triggered, ultimately granting the attacker full system control via MSI backdoors. What makes this campaign particularly notable is its combination of\u00a0social engineering<\/strong>,\u00a0Living-off-the-Land (LotL) techniques<\/strong>, and\u00a0public cloud infrastructure<\/strong>\u00a0to evade security solutions.<\/span><\/p>\n

Threat landscape<\/span><\/h2>\n

This campaign reflects a growing trend of abusing trusted communication platforms like WhatsApp to deliver malware. Rather than relying on traditional email phishing, attackers exploit the inherent trust users place in familiar messaging applications to lower their psychological defenses. Notably,\u00a0the lure content used to convince victims to open the VBS file has not yet been identified<\/strong>.<\/span><\/p>\n

Detailed attack chain<\/span><\/h2>\n

The campaign unfolds across four distinct stages, each building the foundation for the next:<\/span><\/p>\n

\"Detailed<\/a><\/p>\n

Stage 1 – Initial access via WhatsApp<\/span><\/h3>\n

A malicious VBS file is sent directly through a WhatsApp message. Upon execution, the script:<\/span><\/p>\n

    \n
  • Creates a hidden directory at\u00a0C:\\ProgramData\\EDS8738<\/code><\/span><\/li>\n
  • Copies and\u00a0renames legitimate Windows tools<\/strong>:\u00a0curl.exe<\/code>\u00a0\u2192\u00a0netapi.dll<\/code>,\u00a0bitsadmin.exe<\/code>\u00a0\u2192\u00a0sc.exe<\/code><\/span><\/li>\n
  • The renamed files retain their original PE metadata (OriginalFileName<\/code>), creating a detectable anomaly for EDR solutions<\/span><\/li>\n<\/ul>\n

    Stage 2 – Cloud payload retrieval<\/span><\/h3>\n

    Using the renamed binaries with downloader flags, the malware connects to reputable cloud services to fetch secondary payloads:<\/span><\/p>\n

      \n
    • auxs.vbs<\/code>\u00a0and\u00a0WinUpdate_KB5034231.vbs<\/code>\u00a0are hosted on\u00a0AWS S3<\/strong>,\u00a0Tencent Cloud<\/strong>, and\u00a0Backblaze B2<\/strong><\/span><\/li>\n
    • This technique makes malicious requests appear as normal system traffic, making it extremely difficult to distinguish from legitimate activity<\/span><\/li>\n<\/ul>\n

      Stage 3 – Privilege escalation & persistence<\/span><\/h3>\n

      This is the most critical stage of the campaign:<\/span><\/p>\n

        \n
      • The malware modifies the\u00a0ConsentPromptBehaviorAdmin<\/code>\u00a0registry value to\u00a0disable UAC prompts<\/strong><\/span><\/li>\n
      • It repeatedly attempts to launch\u00a0cmd.exe<\/code>\u00a0with elevated privileges, looping until successful or forcibly interrupted<\/span><\/li>\n
      • Persistence is written to\u00a0HKLM\\Software\\Microsoft\\Win<\/code>\u00a0to survive reboots<\/span><\/li>\n
      • The entire privilege escalation process occurs\u00a0without any user interaction<\/strong><\/span><\/li>\n<\/ul>\n

        Stage 4 – Final backdoor deployment<\/span><\/h3>\n

        The final stage installs MSI packages that are\u00a0not digitally signed<\/strong>:<\/span><\/p>\n\n\n\n\n\n\n\n\n
        Filename<\/span><\/th>\nDescription<\/span><\/th>\n<\/tr>\n<\/thead>\n
        AnyDesk.msi<\/code><\/span><\/td>\nImpersonates legitimate remote control software, establishes persistent access<\/span><\/td>\n<\/tr>\n
        Setup.msi<\/code><\/span><\/td>\nGeneric backdoor installer<\/span><\/td>\n<\/tr>\n
        WinRAR.msi<\/code><\/span><\/td>\nImpersonates a popular archiving tool<\/span><\/td>\n<\/tr>\n
        LinkPoint.msi<\/code><\/span><\/td>\nAdditional backdoor installer<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        Through the fake AnyDesk installation, the attacker achieves\u00a0persistent remote access<\/strong>, enabling data exfiltration, additional malware deployment, or enrollment of the system into a botnet.<\/span><\/p>\n

        Technical analysis<\/span><\/h2>\n

        MITRE ATT&CK mapping<\/span><\/h3>\n\n\n\n\n\n\n\n\n\n\n\n
        Tactic<\/span><\/th>\nTechnique<\/span><\/th>\nID<\/span><\/th>\nDetails<\/span><\/th>\n<\/tr>\n<\/thead>\n
        Initial Access<\/span><\/td>\nPhishing via Messaging Platform<\/span><\/td>\nT1566<\/span><\/td>\nVBS delivered via WhatsApp<\/span><\/td>\n<\/tr>\n
        Execution<\/span><\/td>\nUser Execution: Malicious File<\/span><\/td>\nT1204.002<\/span><\/td>\nVictim manually executes VBS<\/span><\/td>\n<\/tr>\n
        Defense Evasion<\/span><\/td>\nMasquerading: Rename System Utilities<\/span><\/td>\nT1036.003<\/span><\/td>\ncurl.exe \u2192 netapi.dll<\/span><\/td>\n<\/tr>\n
        Defense Evasion<\/span><\/td>\nAbuse of Trusted Cloud Services<\/span><\/td>\nT1102<\/span><\/td>\nAWS, Tencent, Backblaze<\/span><\/td>\n<\/tr>\n
        Privilege Escalation<\/span><\/td>\nAbuse Elevation Control: Bypass UAC<\/span><\/td>\nT1548.002<\/span><\/td>\nRegistry UAC bypass<\/span><\/td>\n<\/tr>\n
        Persistence<\/span><\/td>\nRegistry Run Keys \/ Startup Folder<\/span><\/td>\nT1547.001<\/span><\/td>\nHKLM registry modification<\/span><\/td>\n<\/tr>\n
        Command & Control<\/span><\/td>\nRemote Access Software<\/span><\/td>\nT1219<\/span><\/td>\nAnyDesk backdoor<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        Evasion highlights<\/span><\/h3>\n

        This campaign is particularly dangerous due to the simultaneous use of multiple evasion techniques. The combination of legitimate Windows binaries (LotL) with cloud hosting renders signature-based and domain reputation-based security solutions largely ineffective. Furthermore,\u00a0delayed execution<\/strong>\u00a0and staged delivery help bypass sandbox behavioral analysis systems.<\/span><\/p>\n

        Indicators of compromise (IoCs)<\/span><\/h2>\n

        SHA-256 hashes – VBS scripts (Initial stage)<\/span><\/h3>\n\n\n\n\n\n\n
        Hash<\/span><\/th>\nDescription<\/span><\/th>\n<\/tr>\n<\/thead>\n
        a773bf0d400986f9bcd001c84f2e1a0b614c14d9088f3ba23ddc0c75539dc9e0<\/code><\/span><\/td>\nInitial VBS from WhatsApp<\/span><\/td>\n<\/tr>\n
        22b82421363026940a565d4ffbb7ce4e7798cdc5f53dda9d3229eb8ef3e0289a<\/code><\/span><\/td>\nInitial VBS from WhatsApp<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        SHA-256 hashes – VBS droppers (Cloud stage)<\/span><\/h3>\n\n\n\n\n\n\n\n\n
        Hash<\/span><\/th>\nDescription<\/span><\/th>\n<\/tr>\n<\/thead>\n
        91ec2ede66c7b4e6d4c8a25ffad4670d5fd7ff1a2d266528548950df2a8a927a<\/code><\/span><\/td>\nScript from cloud storage<\/span><\/td>\n<\/tr>\n
        1735fcb8989c99bc8b9741f2a7dbf9ab42b7855e8e9a395c21f11450c35ebb0c<\/code><\/span><\/td>\nScript from cloud storage<\/span><\/td>\n<\/tr>\n
        5cd4280b7b5a655b611702b574b0b48cd46d7729c9bbdfa907ca0afa55971662<\/code><\/span><\/td>\nScript from cloud storage<\/span><\/td>\n<\/tr>\n
        630dfd5ab55b9f897b54c289941303eb9b0e07f58ca5e925a0fa40f12e752653<\/code><\/span><\/td>\nScript from cloud storage<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        SHA-256 hashes – MSI installers (Final payload)<\/span><\/h3>\n\n\n\n\n\n\n\n
        Hash<\/span><\/th>\nDescription<\/span><\/th>\n<\/tr>\n<\/thead>\n
        dc3b2db1608239387a36f6e19bba6816a39c93b6aa7329340343a2ab42ccd32d<\/code><\/span><\/td>\nMSI installer<\/span><\/td>\n<\/tr>\n
        a2b9e0887751c3d775adc547f6c76fea3b4a554793059c00082c1c38956badc8<\/code><\/span><\/td>\nMSI installer<\/span><\/td>\n<\/tr>\n
        15a730d22f25f87a081bb2723393e6695d2aab38c0eafe9d7058e36f4f589220<\/code><\/span><\/td>\nMSI installer<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        URLs – Cloud payload hosting<\/span><\/h3>\n\n\n\n\n\n\n\n\n\n
        URL<\/span><\/th>\nService<\/span><\/th>\n<\/tr>\n<\/thead>\n
        hxxps[:]\/\/bafauac.s3.ap-southeast-1.amazonaws[.]com<\/code><\/span><\/td>\nAmazon S3<\/span><\/td>\n<\/tr>\n
        hxxps[:]\/\/yifubafu.s3.ap-southeast-1.amazonaws[.]com<\/code><\/span><\/td>\nAmazon S3<\/span><\/td>\n<\/tr>\n
        hxxps[:]\/\/9ding.s3.ap-southeast-1.amazonaws[.]com<\/code><\/span><\/td>\nAmazon S3<\/span><\/td>\n<\/tr>\n
        hxxps[:]\/\/f005.backblazeb2.com\/file\/bsbbmks<\/code><\/span><\/td>\nBackblaze B2<\/span><\/td>\n<\/tr>\n
        hxxps[:]sinjiabo-1398259625[.]cos.ap-singapore.myqcloud.com<\/code><\/span><\/td>\nTencent Cloud<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        C2 domains<\/span><\/h3>\n\n\n\n\n\n\n
        Domain<\/span><\/th>\nRole<\/span><\/th>\n<\/tr>\n<\/thead>\n
        Neescil[.]top<\/code><\/span><\/td>\nCommand & Control<\/span><\/td>\n<\/tr>\n
        velthora[.]top<\/code><\/span><\/td>\nCommand & Control<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        Hunting queries (Microsoft defender \/ KQL)<\/span><\/h2>\n

        The following queries were provided by Microsoft to hunt for related activity:<\/span><\/p>\n

        Detect malicious VBS script execution:<\/strong><\/span><\/p>\n

        DeviceProcessEvents\r\n| where InitiatingProcessFileName has \"wscript.exe\"\r\n| where InitiatingProcessCommandLine has_all (\"wscript.exe\",\".vbs\")\r\n| where ProcessCommandLine has_all (\"ProgramData\",\"-K\",\"-s\",\"-L\",\"-o\", \"https:\")\r\n<\/code>