Think twice before opening unexpected WhatsApp attachments—a new kind of malware attack has let hackers seize control of Windows PCs simply through a single, seemingly harmless file. Here’s how the scheme works and what steps can help protect you.
How a Simple WhatsApp File Opens the Door
It starts with a message on WhatsApp that includes what appears to be a regular .vbs file. VBScript has long been a part of Windows, built to automate day-to-day computer tasks. But attackers have weaponized this familiar file type: once opened, the script launches malware automatically—no further user action is needed, and there’s typically no warning.
Exploiting Legitimate Windows Tools
This malware doesn’t immediately download shady programs from the internet. Instead, it searches your PC for legitimate Windows utilities like curl.exe and bitsadmin.exe. The malware renames these tools to mimic routine system files and hides them in the C:ProgramData folder, which is usually out of sight.
Using these now-camouflaged utilities, the attack downloads malicious software stored on common cloud platforms—including AWS S3, Tencent Cloud, and Backblaze B2. Because the tools and traffic appear normal, many network security systems won’t notice anything suspicious. Experts refer to this method as living-off-the-land, since it uses a device’s existing resources against itself.
Breaking Through Windows Security
The next stage focuses on Windows’ User Account Control (UAC) feature, which protects your system by requiring confirmation for changes that need administrative rights. If attackers manage to get around UAC, they can then deploy programs like AnyDesk for remote access, as well as utilities such as WinRAR and LinkPoint. At this point, the attackers have full remote access, and the compromised machine can be used for data theft, spying, or as a stepping stone for new attacks.
Detection Is Possible—But Rarely Used
According to Microsoft, there’s a telling flaw in the attackers’ methods. Even if curl.exe (or a similar file) is renamed, its original name stays in the metadata of the executable. In theory, this can allow antivirus software to detect such tampering by checking if a file’s apparent name matches its compiled name. However, most consumer security solutions don’t actively use this method for detection.
Your Best Defense: Caution
No matter how refined this attack may be, it always starts with a simple act: opening a file sent over WhatsApp—sometimes one that can even reply for you thanks to AI-driven features. The safest approach is to only open files from contacts you trust explicitly.
Only trust files and messages from people you know.
