Cybersecurity researchers have uncovered a sophisticated new attack chain that delivers malicious VBS scripts via WhatsApp messages, tricking users into execution and creating hidden folders for stealthy infection.

The multi-stage campaign uses renamed legitimate Windows tools like curl.exe and bitsadmin.exe to download secondary VBS payloads from cloud services such as AWS S3, while tampering with User Account Control to gain elevated privileges silently. Attackers then install unsigned MSI backdoors mimicking tools like AnyDesk or WinRAR, establishing persistence and remote access for data theft or further malware deployment.

Microsoft Defender identified the campaign in late February 2026, highlighting its reliance on living-off-the-land techniques and social engineering. Users should avoid running unexpected WhatsApp attachments and enable strong endpoint protections to mitigate risks.