New Malware Attack Via WhatsApp Attacking Windows System to Enable Remote Access For Attackers

A new and active malware campaign is spreading through WhatsApp, targeting everyday Windows users across more than a dozen countries.

The threat uses malicious script files disguised as routine financial documents, tricking people into running harmful code on their own machines.

Once opened, the file quietly sets off a chain of events that ends with attackers gaining full remote access to the victim’s system.

The campaign was first observed in June 2026 and remains active at the time of reporting. Victims have been identified in Malaysia, Brazil, India, Mexico, Singapore, the United Kingdom, Spain, Taiwan, Australia, Russia, and Vietnam.

Malaysia has been hit the hardest, accounting for roughly 80 percent of all recorded infections. Researchers at Securelist identified and analyzed the campaign in detail.

According to Securelist report shared with Cyber Security News (CSN), the threat actor behind this campaign gained access to real WhatsApp accounts and used them to silently send malicious attachments to everyone in the compromised contact lists.

Since the messages appeared to come from known contacts, recipients were far more likely to open them without suspicion.

The attachments are VBScript files, a type of script that Windows can run automatically through a built-in tool called Windows Script Host.

The files carried names like “Financial Reports.vbs,” “Debt Statement.vbs,” and “Account Statement.vbs,” along with versions written in Portuguese, French, German, and Malay.

This multi-language approach strongly suggests the campaign was designed to reach victims in several regions at once.

What makes this attack stand out is its use of legitimate software as the final payload. Rather than deploying a traditional virus or data stealer, the attacker installs a genuine remote management tool on the victim’s machine.

This allows the attacker to control the infected system just like a corporate IT team would, making detection far more difficult.

New Malware Attack Via WhatsApp Attacking Windows System

The infection begins the moment a user opens the VBScript attachment in WhatsApp Desktop or through a browser using WhatsApp Web.

The script launches silently through Windows Script Host and immediately begins preparing the system for further compromise.

It creates a hidden folder under the Public Documents directory using randomized names like “MSUpdate_random” to avoid attracting attention.

From there, the first script downloads two additional script files from attacker-controlled servers. The first of these tries to modify a Windows security setting known as User Account Control, which normally alerts users before any major system changes are made.

By setting this protection to zero, the attacker clears the path for the second script to install software without any prompts appearing on screen.

The second downloaded script fetches a ZIP archive containing a fully pre-configured installation package for a remote management agent.

Once extracted and executed, this package installs itself silently using Windows Installer and connects back to attacker-controlled servers. At that point, the attacker has persistent and quiet remote access to everything on the victim’s machine.

Signs Pointing to a Chinese-Speaking Operator

Security researchers noted several details within the script files that point toward a Chinese-speaking developer.

Multiple variants of the VBScript contained comments and annotations written in simplified Chinese characters, including references to Windows Update modules and system integrity checks. These comments appeared consistently across different versions of the script.

Infrastructure overlaps also raised flags. One of the attacker-controlled server addresses had previously appeared in connection with malware families known as ValleyRAT and Gh0st RAT.

While this does not confirm a definitive link, researchers assess with low confidence that the campaign was likely conducted by a Chinese-speaking operator.

Users are strongly advised to avoid opening any attachments received through WhatsApp, even from known contacts, unless the file has been verified through another channel.

File types such as VBS, VBE, EXE, BAT, CMD, JS, and PS1 should never be opened without independent confirmation.

Keeping Windows security settings intact and running current endpoint protection can significantly reduce the risk of falling victim to campaigns like this one.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.